diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 9be2825a93ba..be1e8934e57a 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -21415,6 +21415,12 @@
     githubId = 64630479;
     name = "Schweber";
   };
+  SchweGELBin = {
+    email = "abramjannikmichael06@gmail.com";
+    name = "Jannik Michael Abram";
+    github = "SchweGELBin";
+    githubId = 67663319;
+  };
   sciencentistguy = {
     email = "jamie@quigley.xyz";
     name = "Jamie Quigley";
diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index 842a5960503e..3746a1440746 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -786,7 +786,6 @@ with lib.maintainers;
       ma27
       fadenb
       mguentner
-      ralith
       dandellion
       nickcao
       teutat3s
diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index 80ab576b438c..9c21116b041d 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -239,6 +239,10 @@
 
 - `pkgs.nextcloud28` has been removed since it's out of support upstream.
 
+- `teleport` has been upgraded from major version 16 to major version 17.
+  Refer to [upstream upgrade instructions](https://goteleport.com/docs/upgrading/overview/)
+  and [release notes for v17](https://goteleport.com/docs/changelog/#1701-11152024).
+
 - `services.cloudflare-dyndns.apiTokenFile` now must be just your Cloudflare api token. Previously it was supposed to be a file of the form `CLOUDFLARE_API_TOKEN=...`.
 
 - Emacs lisp build helpers, such as `emacs.pkgs.melpaBuild`, now enables `__structuredAttrs` by default.
diff --git a/nixos/modules/services/web-apps/nextcloud-notify_push.nix b/nixos/modules/services/web-apps/nextcloud-notify_push.nix
index 1246a6e6394c..2efb73964160 100644
--- a/nixos/modules/services/web-apps/nextcloud-notify_push.nix
+++ b/nixos/modules/services/web-apps/nextcloud-notify_push.nix
@@ -83,9 +83,13 @@ in
         description = "Push daemon for Nextcloud clients";
         documentation = [ "https://github.com/nextcloud/notify_push" ];
         after = [
+          "nextcloud-setup.service"
           "phpfpm-nextcloud.service"
           "redis-nextcloud.service"
         ];
+        requires = [
+          "nextcloud-setup.service"
+        ];
         wantedBy = [ "multi-user.target" ];
         environment = {
           NEXTCLOUD_URL = cfg.nextcloudUrl;
diff --git a/nixos/tests/jirafeau.nix b/nixos/tests/jirafeau.nix
index ba15b837d10f..6cace65ed6f3 100644
--- a/nixos/tests/jirafeau.nix
+++ b/nixos/tests/jirafeau.nix
@@ -3,7 +3,7 @@ import ./make-test-python.nix (
 
   {
     name = "jirafeau";
-    meta.maintainers = with lib.maintainers; [ davidtwco ];
+    meta.maintainers = [ ];
 
     nodes.machine =
       { pkgs, ... }:
diff --git a/pkgs/applications/audio/reaper/default.nix b/pkgs/applications/audio/reaper/default.nix
index 6690b3cf7fc4..db313704dfad 100644
--- a/pkgs/applications/audio/reaper/default.nix
+++ b/pkgs/applications/audio/reaper/default.nix
@@ -38,17 +38,17 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "reaper";
-  version = "7.34";
+  version = "7.35";
 
   src = fetchurl {
     url = url_for_platform version stdenv.hostPlatform.qemuArch;
     hash =
       if stdenv.hostPlatform.isDarwin then
-        "sha256-Z3m9qwNFH4bHNG1DD4Lbcr7N9b2swwE73iIh6NPX0l4="
+        "sha256-X3KNESHUmcs3zcwURKvaDqvkf9P/XncO/hpsOGxKMmg="
       else
         {
-          x86_64-linux = "sha256-R6nFi6OPBTIJhg752o9r0lGb24VYobiaWgp5bfvFykg=";
-          aarch64-linux = "sha256-uoPf9rfYk0JyHcbqV3hXBqzmInuUd0xrrWCAYiT3/9I=";
+          x86_64-linux = "sha256-VD2VUTZUYi+7rDCG1joElajbfxLiramQwwrUgDDpuPI=";
+          aarch64-linux = "sha256-TFhv4CS7VCysup3Xy/uXHxaWhG4J8WCgxtaooGFj4vw=";
         }
         .${stdenv.hostPlatform.system};
   };
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 9bad918bb045..5e37857ce43a 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -1,4 +1,4 @@
-# GENERATED by ./pkgs/applications/editors/vim/plugins/update.py. Do not edit!
+# GENERATED by ./pkgs/applications/editors/vim/plugins/utils/update.py. Do not edit!
 { lib, buildVimPlugin, buildNeovimPlugin, fetchFromGitHub }:
 
 final: prev:
@@ -8807,6 +8807,19 @@ final: prev:
     meta.hydraPlatforms = [ ];
   };
 
+  neomutt-vim = buildVimPlugin {
+    pname = "neomutt.vim";
+    version = "2024-10-13";
+    src = fetchFromGitHub {
+      owner = "neomutt";
+      repo = "neomutt.vim";
+      rev = "0081eb9ab89d06b5d29678721463e0148b4b4575";
+      sha256 = "15s3il16i4h6z47x9dsjmdafb6syybvgfvzqpx4j57s90ipj1c87";
+    };
+    meta.homepage = "https://github.com/neomutt/neomutt.vim/";
+    meta.hydraPlatforms = [ ];
+  };
+
   neon = buildVimPlugin {
     pname = "neon";
     version = "2022-11-27";
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 744d7cfa8513..9de4fa3eb844 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -675,6 +675,7 @@ https://github.com/NeogitOrg/neogit/,,
 https://github.com/Shougo/neoinclude.vim/,,
 https://github.com/neomake/neomake/,,
 https://github.com/Shougo/neomru.vim/,,
+https://github.com/neomutt/neomutt.vim/,HEAD,
 https://github.com/rafamadriz/neon/,,
 https://github.com/ii14/neorepl.nvim/,HEAD,
 https://github.com/nvim-neorg/neorg-telescope/,HEAD,
diff --git a/pkgs/applications/editors/vscode/extensions/ms-python.python/default.nix b/pkgs/applications/editors/vscode/extensions/ms-python.python/default.nix
index df96b37116c9..4904c2494e70 100644
--- a/pkgs/applications/editors/vscode/extensions/ms-python.python/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-python.python/default.nix
@@ -8,13 +8,7 @@
   # Defaults to `false` as we expect it to be project specific most of the time.
   pythonUseFixed ? false,
   # For updateScript
-  writeScript,
-  bash,
-  curl,
-  coreutils,
-  gnused,
-  jq,
-  nix,
+  vscode-extensions-update-script,
 }:
 
 vscode-utils.buildVscodeMarketplaceExtension rec {
@@ -51,35 +45,7 @@ vscode-utils.buildVscodeMarketplaceExtension rec {
         --replace-fail "\"default\":\"python\"" "\"default\":\"${python3.interpreter}\""
     '';
 
-  passthru.updateScript = writeScript "update" ''
-    #! ${bash}/bin/bash
-
-    set -eu -o pipefail
-
-    export PATH=${
-      lib.makeBinPath [
-        curl
-        coreutils
-        gnused
-        jq
-        nix
-      ]
-    }
-
-    api=$(curl -s 'https://marketplace.visualstudio.com/_apis/public/gallery/extensionquery' \
-      -H 'accept: application/json;api-version=3.0-preview.1' \
-      -H 'content-type: application/json' \
-      --data-raw '{"filters":[{"criteria":[{"filterType":7,"value":"${mktplcRef.publisher}.${mktplcRef.name}"}]}],"flags":16}')
-    # Find the latest version compatible with stable vscode version
-    version=$(echo $api | jq -r '.results[0].extensions[0].versions | map(select(has("properties"))) | map(select(.properties | map(select(.key == "Microsoft.VisualStudio.Code.Engine")) | .[0].value | test("\\^[0-9.]+$"))) | .[0].version')
-
-    if [[ $version != ${mktplcRef.version} ]]; then
-      tmp=$(mktemp)
-      curl -sLo $tmp $(echo ${(import ../mktplcExtRefToFetchArgs.nix mktplcRef).url} | sed "s|${mktplcRef.version}|$version|")
-      hash=$(nix hash file --type sha256 --base32 --sri $tmp)
-      sed -i -e "s|${mktplcRef.hash}|$hash|" -e "s|${mktplcRef.version}|$version|" pkgs/applications/editors/vscode/extensions/ms-python.python/default.nix
-    fi
-  '';
+  passthru.updateScript = vscode-extensions-update-script { };
 
   meta = {
     description = "Visual Studio Code extension with rich support for the Python language";
diff --git a/pkgs/applications/editors/vscode/extensions/rooveterinaryinc.roo-cline/default.nix b/pkgs/applications/editors/vscode/extensions/rooveterinaryinc.roo-cline/default.nix
index 17fbe6c2a248..47f844424189 100644
--- a/pkgs/applications/editors/vscode/extensions/rooveterinaryinc.roo-cline/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/rooveterinaryinc.roo-cline/default.nix
@@ -1,6 +1,7 @@
 {
   lib,
   vscode-utils,
+  vscode-extensions-update-script,
 }:
 
 vscode-utils.buildVscodeMarketplaceExtension {
@@ -11,6 +12,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
     hash = "sha256-7A8BQHUu7CYA28fHv68Zvf6zhlJwwXZaNVLb+/cBAIg=";
   };
 
+  passthru.updateScript = vscode-extensions-update-script { };
+
   meta = {
     description = "AI-powered autonomous coding agent that lives in your editor";
     downloadPage = "https://marketplace.visualstudio.com/items?itemName=RooVeterinaryInc.roo-cline";
diff --git a/pkgs/applications/emulators/libretro/cores/beetle-psx.nix b/pkgs/applications/emulators/libretro/cores/beetle-psx.nix
index 015d49aa644f..50679b0bf8c9 100644
--- a/pkgs/applications/emulators/libretro/cores/beetle-psx.nix
+++ b/pkgs/applications/emulators/libretro/cores/beetle-psx.nix
@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-psx" + lib.optionalString withHw "-hw";
-  version = "0-unstable-2025-03-16";
+  version = "0-unstable-2025-03-28";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "beetle-psx-libretro";
-    rev = "d4a2ce15eea2e93ba984d1800fe7151b14df0de4";
-    hash = "sha256-Xq3NOH6rsuZQnifE0brX98okchKrLG7fB8eAgt+aK9A=";
+    rev = "e2522914f72291ad7232d996e7eabdf167b1b414";
+    hash = "sha256-uxnRNP5BRpabHLjuI4IiLzqCfRobETEMnwJ9mw+ZdaE=";
   };
 
   extraBuildInputs = lib.optionals withHw [
diff --git a/pkgs/applications/emulators/libretro/cores/mame2003-plus.nix b/pkgs/applications/emulators/libretro/cores/mame2003-plus.nix
index c131678f86a1..876cc55cc95b 100644
--- a/pkgs/applications/emulators/libretro/cores/mame2003-plus.nix
+++ b/pkgs/applications/emulators/libretro/cores/mame2003-plus.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mame2003-plus";
-  version = "0-unstable-2025-03-15";
+  version = "0-unstable-2025-03-27";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "mame2003-plus-libretro";
-    rev = "ea05ce215a0903862bd7c1f31e1876e569381e4d";
-    hash = "sha256-6NtZk6yxU4G93sLsU8LvSckemUQXuDROiUnFD3wgz0M=";
+    rev = "4df08f409666e46a0a2d94c3cebcfbba72975ca9";
+    hash = "sha256-Dp4f3j9Zm3BLMftEJSDSYrqPy1zJ8miStiUTI9mFdLw=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/emulators/libretro/cores/mame2003.nix b/pkgs/applications/emulators/libretro/cores/mame2003.nix
index 6ca5c9440db4..ddc92524eeac 100644
--- a/pkgs/applications/emulators/libretro/cores/mame2003.nix
+++ b/pkgs/applications/emulators/libretro/cores/mame2003.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mame2003";
-  version = "0-unstable-2025-03-14";
+  version = "0-unstable-2025-03-18";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "mame2003-libretro";
-    rev = "9c05757528afb96278ececf71454072cd4e57946";
-    hash = "sha256-v4LG52JbekLFPotMpoZyvYYj27I1SL1DEe01GaeMRjk=";
+    rev = "8565eec2e963b78f07a5a1f4b74df1271f3ece13";
+    hash = "sha256-pChPUwKIOtP4nl9ReqlrgxOJ/qcO6m2SnHhx3Y+hktM=";
   };
 
   # Fix build with GCC 14
diff --git a/pkgs/applications/emulators/libretro/cores/nestopia.nix b/pkgs/applications/emulators/libretro/cores/nestopia.nix
index 43a3483f2850..9ec7d0031f50 100644
--- a/pkgs/applications/emulators/libretro/cores/nestopia.nix
+++ b/pkgs/applications/emulators/libretro/cores/nestopia.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "nestopia";
-  version = "0-unstable-2025-03-16";
+  version = "0-unstable-2025-03-22";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "nestopia";
-    rev = "83d4f6227d14c817c8c75d2b6ad69514acb8fc4b";
-    hash = "sha256-3BTQbtascDymbJK1ECjaoE9z1fVMnmvcdO+c4aCWuFE=";
+    rev = "b3eb368603cd519d54bb4886d2934ee4fd188081";
+    hash = "sha256-gaMZEP+8vCb/b9lhrXcUK4N7v9uxX/FVgnzK48rxyHQ=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/emulators/libretro/cores/pcsx-rearmed.nix b/pkgs/applications/emulators/libretro/cores/pcsx-rearmed.nix
index 92e9c16d6110..f107b64f8d5d 100644
--- a/pkgs/applications/emulators/libretro/cores/pcsx-rearmed.nix
+++ b/pkgs/applications/emulators/libretro/cores/pcsx-rearmed.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "pcsx-rearmed";
-  version = "0-unstable-2025-03-17";
+  version = "0-unstable-2025-03-26";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "pcsx_rearmed";
-    rev = "b53685f32320245d5d500cf59963d19ddff2f7d4";
-    hash = "sha256-YeTZXkoqk9sgWum+Pj6Bj7SojVBqm/m4CVA2GJT69Wg=";
+    rev = "4b0894f55fb7244b522fb720f41363e86f2085fe";
+    hash = "sha256-748TR87fO1BLBWwDAJxkEBr327g64RUTdBvvMu6lSEI=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/applications/emulators/libretro/cores/picodrive.nix b/pkgs/applications/emulators/libretro/cores/picodrive.nix
index 52285d4e38a7..f7a8e3bc1bc9 100644
--- a/pkgs/applications/emulators/libretro/cores/picodrive.nix
+++ b/pkgs/applications/emulators/libretro/cores/picodrive.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "picodrive";
-  version = "0-unstable-2025-02-19";
+  version = "0-unstable-2025-03-25";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "picodrive";
-    rev = "6123398dfe16ada8048f5ee5255e1a9e726edbf5";
-    hash = "sha256-rgFmdZBtWpVClfcVMBa7tSGb98z5ejCln/w4GrFu4VA=";
+    rev = "752c266491ae8775dab9a98dbd94472f42b9b16f";
+    hash = "sha256-l9qYOUyQzyleWeQv74rEOEwOk6iyH43WVIUHcC6Aw2Y=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/emulators/libretro/cores/play.nix b/pkgs/applications/emulators/libretro/cores/play.nix
index 410ae16d3baf..a0dd0c6399db 100644
--- a/pkgs/applications/emulators/libretro/cores/play.nix
+++ b/pkgs/applications/emulators/libretro/cores/play.nix
@@ -14,13 +14,13 @@
 }:
 mkLibretroCore {
   core = "play";
-  version = "0-unstable-2025-03-10";
+  version = "0-unstable-2025-03-25";
 
   src = fetchFromGitHub {
     owner = "jpd002";
     repo = "Play-";
-    rev = "b15a49e31172f05dfdb1b1a15ea71e8a870c27ae";
-    hash = "sha256-+jNdMeW11w8Bg4TZD8fYOFGOPxcHHu+apR+w2QZCIXw=";
+    rev = "01d094c0c3ed723b0747079afddfd319001f01d4";
+    hash = "sha256-o8tfYg88spRZBDokc/dkRsVvvfGejYVnDQfvQ1BBRps=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/misc/pastel/default.nix b/pkgs/applications/misc/pastel/default.nix
index 4a8ad4c60ab0..3265a1b61299 100644
--- a/pkgs/applications/misc/pastel/default.nix
+++ b/pkgs/applications/misc/pastel/default.nix
@@ -30,7 +30,7 @@ rustPlatform.buildRustPackage rec {
       asl20 # or
       mit
     ];
-    maintainers = with maintainers; [ davidtwco ];
+    maintainers = [ ];
     mainProgram = "pastel";
   };
 }
diff --git a/pkgs/applications/networking/browsers/librewolf/src.json b/pkgs/applications/networking/browsers/librewolf/src.json
index ec5a9854a4de..510aab612186 100644
--- a/pkgs/applications/networking/browsers/librewolf/src.json
+++ b/pkgs/applications/networking/browsers/librewolf/src.json
@@ -1,11 +1,11 @@
 {
-  "packageVersion": "136.0.1-1",
+  "packageVersion": "136.0.4-1",
   "source": {
-    "rev": "136.0.1-1",
-    "hash": "sha256-IGvqZmrr5q7Q5ikrDFgFiQucD0eColka702LjADGngU="
+    "rev": "136.0.4-1",
+    "hash": "sha256-ymW9vj4CariMaswrMQRKYEvTofFRjc50gF9EmTuhsRA="
   },
   "firefox": {
-    "version": "136.0.1",
-    "hash": "sha512-5YM8z5d5bBW1FWNXQnYh0fLR1+5VtTJi85NerbmCKcdKNVu+L3KkFo7E4p3T+D9OrKmcUhXWG9CHR1Mx01IqvQ=="
+    "version": "136.0.4",
+    "hash": "sha512-wiUqpi0BXO1lNMsqwHH2gImZe0ZpAIPMHv9LrTBq5shlQ3Ge0tNfb5c790Rn1qBKukYNMJwG3qQl52xyDjROKA=="
   }
 }
diff --git a/pkgs/applications/networking/cluster/k3s/1_29/images-versions.json b/pkgs/applications/networking/cluster/k3s/1_29/images-versions.json
index 0c204891b043..b045a685e530 100644
--- a/pkgs/applications/networking/cluster/k3s/1_29/images-versions.json
+++ b/pkgs/applications/networking/cluster/k3s/1_29/images-versions.json
@@ -1,18 +1,18 @@
 {
   "airgap-images-amd64": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.29.14%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "1b03a9b0f21f86e607a6d259805c6359c640ae10c08af487894cefe4f5f8182c"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.29.15%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
+    "sha256": "b3b340da3d88c6723f18cf6219edf50745d5a749cb552bd2d3eee0b1281dd5a2"
   },
   "airgap-images-arm": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.29.14%2Bk3s1/k3s-airgap-images-arm.tar.zst",
-    "sha256": "caf185c0fb0bec69e9d4f74d4d08f0ab0086cf8d0c3909c39c17d175bf6ad612"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.29.15%2Bk3s1/k3s-airgap-images-arm.tar.zst",
+    "sha256": "571f0addf5253ed0e98864157c885fbd14fc67f8efcfd638cc36ade48f903b8c"
   },
   "airgap-images-arm64": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.29.14%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "69160276fb841a166c502beb32ab43fc38ecc3ed9c3064b569c4db0bdd0be692"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.29.15%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
+    "sha256": "f2fc003d8ec5c1ac66d0eeb9e410a443a0af3f5b23367d3578c55c6e9e0c618a"
   },
   "images-list": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.29.14%2Bk3s1/k3s-images.txt",
-    "sha256": "ca328934c0bb1d2ffb6b416020c689237a65190ad3eb564a300f12bb24d69110"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.29.15%2Bk3s1/k3s-images.txt",
+    "sha256": "81328fb53d1dfd0de1fb9663b00fa1dc34a2da242a33e562595fec7b448bdce1"
   }
 }
diff --git a/pkgs/applications/networking/cluster/k3s/1_29/versions.nix b/pkgs/applications/networking/cluster/k3s/1_29/versions.nix
index 8c219b67f758..43fa8d0ff1e0 100644
--- a/pkgs/applications/networking/cluster/k3s/1_29/versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_29/versions.nix
@@ -1,15 +1,15 @@
 {
-  k3sVersion = "1.29.14+k3s1";
-  k3sCommit = "6873bccf9cb3221bd422f0f88c2cde6f9855ef70";
-  k3sRepoSha256 = "03f9k1psrdkhz8371q37xncdhshz961sqskw2w7w23pgngxfdqsl";
-  k3sVendorHash = "sha256-RvDtV4n4qqi2KajmhjEELi6CFeJ1H+Fr4fgdrdoPVeA=";
+  k3sVersion = "1.29.15+k3s1";
+  k3sCommit = "35a47239188444222067c25cc096346adb20401f";
+  k3sRepoSha256 = "0vynlcnmhhf82hr2rv01km5jyp2c2zb7872nnd8kzdxdw3jcqp7x";
+  k3sVendorHash = "sha256-+es8ua7JuDnUXej6hqE1ooFS81NhuoYYuA2+4CgUOmU=";
   chartVersions = import ./chart-versions.nix;
   imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
   k3sRootVersion = "0.14.1";
   k3sRootSha256 = "0svbi42agqxqh5q2ri7xmaw2a2c70s7q5y587ls0qkflw5vx4sl7";
   k3sCNIVersion = "1.6.0-k3s1";
   k3sCNISha256 = "0g7zczvwba5xqawk37b0v96xysdwanyf1grxn3l3lhxsgjjsmkd7";
-  containerdVersion = "1.7.23-k3s2";
-  containerdSha256 = "0lp9vxq7xj74wa7hbivvl5hwg2wzqgsxav22wa0p1l7lc1dqw8dm";
+  containerdVersion = "1.7.26-k3s1";
+  containerdSha256 = "0snz0i7xmnvs8bj7140q0lsxqdv835hksvk36baw71w5mbm1w1xz";
   criCtlVersion = "1.29.0-k3s1";
 }
diff --git a/pkgs/applications/networking/cluster/k3s/1_30/images-versions.json b/pkgs/applications/networking/cluster/k3s/1_30/images-versions.json
index 846df8289f7e..651e9a4ccdc1 100644
--- a/pkgs/applications/networking/cluster/k3s/1_30/images-versions.json
+++ b/pkgs/applications/networking/cluster/k3s/1_30/images-versions.json
@@ -1,18 +1,18 @@
 {
   "airgap-images-amd64": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.10%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "a467622184402c9a59cfcee596237120fb138bb65d781741592164c09ae64618"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.11%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
+    "sha256": "aba20bf6082fdccafc36c1ba79ba2705b2ef6f159a3455585c98cf128e767986"
   },
   "airgap-images-arm": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.10%2Bk3s1/k3s-airgap-images-arm.tar.zst",
-    "sha256": "8d830cca9fc2afe38580ddb8f7a3051c4b8b3d18e9c5f8ba67edd777097b1312"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.11%2Bk3s1/k3s-airgap-images-arm.tar.zst",
+    "sha256": "658aa3c0672f2eb3305b262a7187d0fa7fa2759dccdca196612472a9fcc4fd48"
   },
   "airgap-images-arm64": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.10%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "c974d269a8f4220ec7cd86a4878bf8b7a66e7f30ff23cd3fbbd6c0662dc26094"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.11%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
+    "sha256": "f92a63c9f570afd4a9f33b69a441ce057ee4d31359026e9b699f519ae7b8a81a"
   },
   "images-list": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.10%2Bk3s1/k3s-images.txt",
-    "sha256": "ca328934c0bb1d2ffb6b416020c689237a65190ad3eb564a300f12bb24d69110"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.11%2Bk3s1/k3s-images.txt",
+    "sha256": "81328fb53d1dfd0de1fb9663b00fa1dc34a2da242a33e562595fec7b448bdce1"
   }
 }
diff --git a/pkgs/applications/networking/cluster/k3s/1_30/versions.nix b/pkgs/applications/networking/cluster/k3s/1_30/versions.nix
index b7cebb24dfef..23ce5c92fc2e 100644
--- a/pkgs/applications/networking/cluster/k3s/1_30/versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_30/versions.nix
@@ -1,15 +1,15 @@
 {
-  k3sVersion = "1.30.10+k3s1";
-  k3sCommit = "b86a69470cd71af521a4b71499db74a600049f70";
-  k3sRepoSha256 = "1k6msdfx9c4hwwq766yq99km48ck2p1ga2srrc13g17marn81vsr";
-  k3sVendorHash = "sha256-HTUFv8WBIDiBQ860p3RiROF+kDzBekvgBAr2TJh036E=";
+  k3sVersion = "1.30.11+k3s1";
+  k3sCommit = "c2662fbee6d24b3917cf078cbf2ff69cae501340";
+  k3sRepoSha256 = "0zsl5p2dmj3mkcjxbrhsa40r8bhgcrql8r8cxach4nv6y7fcyan5";
+  k3sVendorHash = "sha256-G7RUyFzg3B4X0tdKmD1ep9a4cnVkUmFqBP5t1s8uFLc=";
   chartVersions = import ./chart-versions.nix;
   imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
   k3sRootVersion = "0.14.1";
   k3sRootSha256 = "0svbi42agqxqh5q2ri7xmaw2a2c70s7q5y587ls0qkflw5vx4sl7";
   k3sCNIVersion = "1.6.0-k3s1";
   k3sCNISha256 = "0g7zczvwba5xqawk37b0v96xysdwanyf1grxn3l3lhxsgjjsmkd7";
-  containerdVersion = "1.7.23-k3s2";
-  containerdSha256 = "0lp9vxq7xj74wa7hbivvl5hwg2wzqgsxav22wa0p1l7lc1dqw8dm";
+  containerdVersion = "1.7.26-k3s1";
+  containerdSha256 = "0snz0i7xmnvs8bj7140q0lsxqdv835hksvk36baw71w5mbm1w1xz";
   criCtlVersion = "1.29.0-k3s1";
 }
diff --git a/pkgs/applications/networking/cluster/k3s/1_31/images-versions.json b/pkgs/applications/networking/cluster/k3s/1_31/images-versions.json
index 5fb153fd6b0c..2784691c211d 100644
--- a/pkgs/applications/networking/cluster/k3s/1_31/images-versions.json
+++ b/pkgs/applications/networking/cluster/k3s/1_31/images-versions.json
@@ -1,18 +1,18 @@
 {
   "airgap-images-amd64": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.6%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "d064e908e382a2e2ff4c04121fd3a9c76e64be4c5c1ae00915a3708a1b6ef088"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.7%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
+    "sha256": "2666c3880447979079b94babccf12296706167a5747a0f94962b257bda442449"
   },
   "airgap-images-arm": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.6%2Bk3s1/k3s-airgap-images-arm.tar.zst",
-    "sha256": "c4340a37939008d6fe36d65c0995bb1791d3a2408579afe5d5f4765b7da4f241"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.7%2Bk3s1/k3s-airgap-images-arm.tar.zst",
+    "sha256": "6698d8bcfb029f1d16e0f2aa1d53be09d026995d26a0e4bfd92292f49c68538b"
   },
   "airgap-images-arm64": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.6%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "bee0546d24eb6cbb9360e3281f68238c4539e9fa7ba3ad9a2b34fa7684b77edb"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.7%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
+    "sha256": "0c96ae243b40bb624f9cb34e2851c9cffc77e1ed0127b3e81a2e4a0ff56511a5"
   },
   "images-list": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.6%2Bk3s1/k3s-images.txt",
-    "sha256": "ca328934c0bb1d2ffb6b416020c689237a65190ad3eb564a300f12bb24d69110"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.7%2Bk3s1/k3s-images.txt",
+    "sha256": "81328fb53d1dfd0de1fb9663b00fa1dc34a2da242a33e562595fec7b448bdce1"
   }
 }
diff --git a/pkgs/applications/networking/cluster/k3s/1_31/versions.nix b/pkgs/applications/networking/cluster/k3s/1_31/versions.nix
index 07f5c127e09f..a689a6065a33 100644
--- a/pkgs/applications/networking/cluster/k3s/1_31/versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_31/versions.nix
@@ -1,15 +1,15 @@
 {
-  k3sVersion = "1.31.6+k3s1";
-  k3sCommit = "6ab750f93f790b02553e4e22f7937e1c58e2b7ea";
-  k3sRepoSha256 = "1zblm921w6lfl5mb04z8zn4hqhfn1sjq7q5n4kdfsdvllgdiprfs";
-  k3sVendorHash = "sha256-1ExrTDHRJEfndmMDO4xDzwFNZQCJbHYUOHWcXJIwBGo=";
+  k3sVersion = "1.31.7+k3s1";
+  k3sCommit = "e050ca66d129762a00599628e6f55cfdfab3a7ba";
+  k3sRepoSha256 = "1q531x745ypc08wp43yf0mh0r90gpi6r8bqbmgpvx0nvv9gwn8sb";
+  k3sVendorHash = "sha256-WQPXRwW50/6e1MPnuQCAICROVlrMfARUdHJAgJ7UwQQ=";
   chartVersions = import ./chart-versions.nix;
   imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
   k3sRootVersion = "0.14.1";
   k3sRootSha256 = "0svbi42agqxqh5q2ri7xmaw2a2c70s7q5y587ls0qkflw5vx4sl7";
   k3sCNIVersion = "1.6.0-k3s1";
   k3sCNISha256 = "0g7zczvwba5xqawk37b0v96xysdwanyf1grxn3l3lhxsgjjsmkd7";
-  containerdVersion = "2.0.2-k3s2";
-  containerdSha256 = "1883srp3rlap0a6rx5dnbnxl67aijbymjrqdg7zg3a162j21xz3s";
+  containerdVersion = "2.0.4-k3s2";
+  containerdSha256 = "0v34nh6q0plb50s95gzdkrdfbbch7dps15fmddh5h241yfms8sq6";
   criCtlVersion = "1.31.0-k3s2";
 }
diff --git a/pkgs/applications/networking/cluster/k3s/1_32/images-versions.json b/pkgs/applications/networking/cluster/k3s/1_32/images-versions.json
index 6b59788606d3..0e30a88e86ec 100644
--- a/pkgs/applications/networking/cluster/k3s/1_32/images-versions.json
+++ b/pkgs/applications/networking/cluster/k3s/1_32/images-versions.json
@@ -1,18 +1,18 @@
 {
   "airgap-images-amd64": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.2%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "8195d384955fec1779b9504b4aa3010487c2962e4b6bcc44679e3ccfeaa8c30a"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.3%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
+    "sha256": "2c81a3f3527c590180cd71717ea23d83d023669b38439720fdce62fe23543536"
   },
   "airgap-images-arm": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.2%2Bk3s1/k3s-airgap-images-arm.tar.zst",
-    "sha256": "9ef05658c4cc581622ae681197d2d8c8da460f0fa33579355d4554d760305b64"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.3%2Bk3s1/k3s-airgap-images-arm.tar.zst",
+    "sha256": "97ae9c9825844a0fc034b8a4cb35e739cf10991e633ad2a586899d2a5aa6492d"
   },
   "airgap-images-arm64": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.2%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "7b3eee2ff1c98081eb16cbdbae1f562da0f9a969467d8a1030a39934637acf07"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.3%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
+    "sha256": "80423c5023a7d2e3ad65e59293e46a01f5d5679c371a444d76a86b1cd2f474d1"
   },
   "images-list": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.2%2Bk3s1/k3s-images.txt",
-    "sha256": "f3d1f91460cd90e3957413afb7e5dd8a3356fe324acf656deb4049d84c0d0dec"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.3%2Bk3s1/k3s-images.txt",
+    "sha256": "11373c7d60ed0db9b761b07b80b66240b426bef0ecc34d6f1ac91cd9d1ff085e"
   }
 }
diff --git a/pkgs/applications/networking/cluster/k3s/1_32/versions.nix b/pkgs/applications/networking/cluster/k3s/1_32/versions.nix
index 9f9e762344ba..f5aa4ee5a829 100644
--- a/pkgs/applications/networking/cluster/k3s/1_32/versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_32/versions.nix
@@ -1,15 +1,15 @@
 {
-  k3sVersion = "1.32.2+k3s1";
-  k3sCommit = "381620efbd1933b96f9cfaf37f46dfb5c58403a8";
-  k3sRepoSha256 = "0xaw2b6lawg9jdsli333wwgq7irpig7a7p3kb7khqyhgb8y292qr";
-  k3sVendorHash = "sha256-PB3KWvCqi7KxeiKrP9VHYpE4xdXhVSDQoCuwYQe4RoQ=";
+  k3sVersion = "1.32.3+k3s1";
+  k3sCommit = "079ffa8d99fb859cb8c001455e47efa65535d832";
+  k3sRepoSha256 = "1cvd0668ca06ahhmkhrxwymfpssw75rjfv5n9yajzg1dmkv0cmrv";
+  k3sVendorHash = "sha256-1Kd6gt1envXmzFAtwhjPe9LLsllt2bQ7sryamGcaLRs=";
   chartVersions = import ./chart-versions.nix;
   imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
   k3sRootVersion = "0.14.1";
   k3sRootSha256 = "0svbi42agqxqh5q2ri7xmaw2a2c70s7q5y587ls0qkflw5vx4sl7";
   k3sCNIVersion = "1.6.0-k3s1";
   k3sCNISha256 = "0g7zczvwba5xqawk37b0v96xysdwanyf1grxn3l3lhxsgjjsmkd7";
-  containerdVersion = "2.0.2-k3s2";
-  containerdSha256 = "1883srp3rlap0a6rx5dnbnxl67aijbymjrqdg7zg3a162j21xz3s";
+  containerdVersion = "2.0.4-k3s2";
+  containerdSha256 = "0v34nh6q0plb50s95gzdkrdfbbch7dps15fmddh5h241yfms8sq6";
   criCtlVersion = "1.31.0-k3s2";
 }
diff --git a/pkgs/applications/networking/instant-messengers/franz/default.nix b/pkgs/applications/networking/instant-messengers/franz/default.nix
index 58265e71823f..e5ba8abc06bd 100644
--- a/pkgs/applications/networking/instant-messengers/franz/default.nix
+++ b/pkgs/applications/networking/instant-messengers/franz/default.nix
@@ -17,7 +17,7 @@ mkFranzDerivation rec {
     homepage = "https://meetfranz.com";
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.free;
-    maintainers = [ maintainers.davidtwco ];
+    maintainers = [ ];
     platforms = [ "x86_64-linux" ];
     hydraPlatforms = [ ];
   };
diff --git a/pkgs/applications/video/mpv/default.nix b/pkgs/applications/video/mpv/default.nix
index 4a02a3544140..24936fef4acc 100644
--- a/pkgs/applications/video/mpv/default.nix
+++ b/pkgs/applications/video/mpv/default.nix
@@ -95,7 +95,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "mpv";
-  version = "0.39.0";
+  version = "0.40.0";
 
   outputs = [
     "out"
@@ -107,8 +107,8 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "mpv-player";
     repo = "mpv";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-BOGh+QBTO7hrHohh+RqjSF8eHQH8jVBPjG/k4eyFaaM=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-x8cDczKIX4+KrvRxZ+72TGlEQHd4Kx7naq0CSoOZGHA=";
   };
 
   postPatch = lib.concatStringsSep "\n" [
@@ -116,7 +116,7 @@ stdenv.mkDerivation (finalAttrs: {
     # between out and dev
     ''
       substituteInPlace meson.build \
-        --replace-fail "conf_data.set_quoted('CONFIGURATION', configuration)" \
+        --replace-fail "conf_data.set_quoted('CONFIGURATION', meson.build_options())" \
                        "conf_data.set_quoted('CONFIGURATION', '<omitted>')"
     ''
     # A trick to patchShebang everything except mpv_identify.sh
@@ -309,6 +309,7 @@ stdenv.mkDerivation (finalAttrs: {
       fpletz
       globin
       ma27
+      SchweGELBin
     ];
     platforms = lib.platforms.unix;
   };
diff --git a/pkgs/by-name/av/avml/package.nix b/pkgs/by-name/av/avml/package.nix
index af9052589340..26ee2bfc8468 100644
--- a/pkgs/by-name/av/avml/package.nix
+++ b/pkgs/by-name/av/avml/package.nix
@@ -11,17 +11,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "avml";
-  version = "0.14.0";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "avml";
     tag = "v${version}";
-    hash = "sha256-MIqQ5NRWAfXm7AblsKCrUiaYN5IGUo2jWJMJZL+w3V4=";
+    hash = "sha256-QN9GLrs0wjlEdkNnN7Q4Uqu1yJlxD7Dx0SnHJnfV/so=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-husTembzDsqjI617spK6aj2de+NaajKCNYDiV2Fd6XQ=";
+  cargoHash = "sha256-u9oYchTvSvlth/Kn6SYuuP2VDVWQDNqueUsKumPooFU=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl ];
diff --git a/pkgs/by-name/bp/bpftrace/package.nix b/pkgs/by-name/bp/bpftrace/package.nix
index d172b09cdc7d..705e28a646bf 100644
--- a/pkgs/by-name/bp/bpftrace/package.nix
+++ b/pkgs/by-name/bp/bpftrace/package.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation rec {
   pname = "bpftrace";
-  version = "0.22.1";
+  version = "0.23.0";
 
   src = fetchFromGitHub {
     owner = "bpftrace";
     repo = "bpftrace";
     rev = "v${version}";
-    hash = "sha256-3qtErf3+T73DE40d6F8vFK1TdHcM/56AYFGGzxpRIug=";
+    hash = "sha256-OAT8nw5fFhKINK8Jy+RJXSvfU40G4fpR/5J1GPoyewY=";
   };
 
   buildInputs = with llvmPackages; [
diff --git a/pkgs/by-name/br/brave/package.nix b/pkgs/by-name/br/brave/package.nix
index 66f570cb1672..8785f5c0f034 100644
--- a/pkgs/by-name/br/brave/package.nix
+++ b/pkgs/by-name/br/brave/package.nix
@@ -3,24 +3,24 @@
 
 let
   pname = "brave";
-  version = "1.76.74";
+  version = "1.76.81";
 
   allArchives = {
     aarch64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_arm64.deb";
-      hash = "sha256-O8hXKkuw86TeKH4lsyqGdKslrCRbw7mzXfHULCGpgxk=";
+      hash = "sha256-Q9BCoSIgP0asYACkHgashQ5h4BITl5My4dxuy50ID8g=";
     };
     x86_64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-      hash = "sha256-tGf3tjZyzgyojDkgFb/SUvZxdVnYFlx6bPTLeFuTtRI=";
+      hash = "sha256-Mzd1qxPUmlZkl7kmuO+rEVT8EE2EF8fQwdF2398gjoI=";
     };
     aarch64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-arm64.zip";
-      hash = "sha256-l9Ufg9w5P0TIl4gXMJ+JK83x+5QZL0i9+k9X05Llwr4=";
+      hash = "sha256-5GrlXZW2uIHNpTXFHStWWfGpz4hINR9z6442n2g9258=";
     };
     x86_64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-x64.zip";
-      hash = "sha256-MH/WT/eUWaJXWln4uiXN1BD+K0jVoX7xqsKZGXQ/BmI=";
+      hash = "sha256-gOZagyA0oM8KvM+FTsYV/vknG6fG/49rfNInQmN/8K4=";
     };
   };
 
diff --git a/pkgs/by-name/ca/cargo-bisect-rustc/package.nix b/pkgs/by-name/ca/cargo-bisect-rustc/package.nix
index 943d196161ac..3a4c056117ba 100644
--- a/pkgs/by-name/ca/cargo-bisect-rustc/package.nix
+++ b/pkgs/by-name/ca/cargo-bisect-rustc/package.nix
@@ -65,6 +65,6 @@ rustPlatform.buildRustPackage rec {
       asl20
       mit
     ];
-    maintainers = with maintainers; [ davidtwco ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/by-name/co/code-cursor/package.nix b/pkgs/by-name/co/code-cursor/package.nix
index 07b98b9e796c..bb57c3b5d15f 100644
--- a/pkgs/by-name/co/code-cursor/package.nix
+++ b/pkgs/by-name/co/code-cursor/package.nix
@@ -2,33 +2,73 @@
   lib,
   stdenvNoCC,
   fetchurl,
+
+  # build
   appimageTools,
+
+  # linux dependencies
+  alsa-lib,
+  at-spi2-atk,
+  autoPatchelfHook,
+  cairo,
+  cups,
+  curlWithGnuTls,
+  egl-wayland,
+  expat,
+  fontconfig,
+  freetype,
+  ffmpeg,
+  glib,
+  glibc,
+  glibcLocales,
+  gtk3,
+  libappindicator-gtk3,
+  libdrm,
+  libgbm,
+  libGL,
+  libnotify,
+  libva-minimal,
+  libxkbcommon,
+  libxkbfile,
   makeWrapper,
-  writeScript,
+  nspr,
+  nss,
+  pango,
+  pciutils,
+  pulseaudio,
+  vivaldi-ffmpeg-codecs,
+  vulkan-loader,
+  wayland,
+
+  # linux installation
+  rsync,
+
+  # darwin build
   undmg,
 }:
 let
   pname = "cursor";
-  version = "0.45.14";
+  version = "0.47.8";
 
   inherit (stdenvNoCC) hostPlatform;
 
   sources = {
     x86_64-linux = fetchurl {
-      url = "https://download.todesktop.com/230313mzl4w4u92/cursor-0.45.14-build-250219jnihavxsz-x86_64.AppImage";
-      hash = "sha256-5MGWJi8TP+13jZf6YMMUU5uYY/3OBTFxtGpirvgj8ZI=";
-    };
-    aarch64-linux = fetchurl {
-      url = "https://download.todesktop.com/230313mzl4w4u92/cursor-0.45.14-build-250219jnihavxsz-arm64.AppImage";
-      hash = "sha256-8OUlPuPNgqbGe2x7gG+m3n3u6UDvgnVekkjJ08pVORs=";
+      url = "https://downloads.cursor.com/production/82ef0f61c01d079d1b7e5ab04d88499d5af500e3/linux/x64/Cursor-0.47.8-82ef0f61c01d079d1b7e5ab04d88499d5af500e3.deb.glibc2.25-x86_64.AppImage";
+      hash = "sha256-3Ph5A+x1hW0SOaX8CF7b/8Fq7eMeBkG1ju9vud6Cbn0=";
     };
+    # Cursor's release for aarch64-linux is the wrong version (temporarily).
+    # aarch64-linux = fetchurl {
+    #   url = "https://download.todesktop.com/230313mzl4w4u92/cursor-0.45.14-build-250219jnihavxsz-arm64.AppImage";
+    #   hash = "sha256-8OUlPuPNgqbGe2x7gG+m3n3u6UDvgnVekkjJ08pVORs=";
+    # };
     x86_64-darwin = fetchurl {
-      url = "https://download.todesktop.com/230313mzl4w4u92/Cursor%200.45.14%20-%20Build%20250219jnihavxsz-x64.dmg";
-      hash = "sha256-NyDY74PZjSjpuTSVaO/l9adPcLX1kytyrFGQjJ/8WcQ=";
+      url = "https://downloads.cursor.com/production/82ef0f61c01d079d1b7e5ab04d88499d5af500e3/darwin/x64/Cursor-darwin-x64.dmg";
+      hash = "sha256-T5N8b/6HexQ2ZchWUb9CL3t9ks93O9WJgrDtxfE1SgU=";
     };
     aarch64-darwin = fetchurl {
-      url = "https://download.todesktop.com/230313mzl4w4u92/Cursor%200.45.14%20-%20Build%20250219jnihavxsz-arm64.dmg";
-      hash = "sha256-A503TxDDFENqMnc1hy/lMMyIgC7YwwRYPJy+tp649Eg=";
+      url = "https://downloads.cursor.com/production/82ef0f61c01d079d1b7e5ab04d88499d5af500e3/darwin/arm64/Cursor-darwin-arm64.dmg";
+      hash = "sha256-ycroylfEZY/KfRiXvfOuTdyyglbg/J7DU12u6Xrsk0s=";
     };
   };
 
@@ -52,9 +92,55 @@ stdenvNoCC.mkDerivation {
   src = if hostPlatform.isLinux then wrappedAppimage else source;
 
   nativeBuildInputs =
-    lib.optionals hostPlatform.isLinux [ makeWrapper ]
+    lib.optionals hostPlatform.isLinux [
+      autoPatchelfHook
+      glibcLocales
+      makeWrapper
+      rsync
+    ]
     ++ lib.optionals hostPlatform.isDarwin [ undmg ];
 
+  buildInputs = lib.optionals hostPlatform.isLinux [
+    alsa-lib
+    at-spi2-atk
+    cairo
+    cups
+    curlWithGnuTls
+    egl-wayland
+    expat
+    ffmpeg
+    glib
+    gtk3
+    libdrm
+    libgbm
+    libGL
+    libGL
+    libva-minimal
+    libxkbcommon
+    libxkbfile
+    nspr
+    nss
+    pango
+    pulseaudio
+    vivaldi-ffmpeg-codecs
+    vulkan-loader
+    wayland
+  ];
+
+  runtimeDependencies = lib.optionals hostPlatform.isLinux [
+    egl-wayland
+    ffmpeg
+    glibc
+    libappindicator-gtk3
+    libnotify
+    libxkbfile
+    pciutils
+    pulseaudio
+    wayland
+    fontconfig
+    freetype
+  ];
+
   sourceRoot = lib.optionalString hostPlatform.isDarwin ".";
 
   # Don't break code signing
@@ -68,13 +154,13 @@ stdenvNoCC.mkDerivation {
 
     ${lib.optionalString hostPlatform.isLinux ''
       cp -r bin $out/bin
-      mkdir -p $out/share/cursor
-      cp -a ${appimageContents}/locales $out/share/cursor
-      cp -a ${appimageContents}/resources $out/share/cursor
-      cp -a ${appimageContents}/usr/share/icons $out/share/
-      install -Dm 644 ${appimageContents}/cursor.desktop -t $out/share/applications/
+      # mkdir -p $out/share/cursor
+      # cp -ar ${appimageContents}/usr/share $out/
 
-      substituteInPlace $out/share/applications/cursor.desktop --replace-fail "AppRun" "cursor"
+      rsync -a -q ${appimageContents}/usr/share $out/ --exclude "*.so"
+
+      # Fix the desktop file to point to the correct location
+      substituteInPlace $out/share/applications/cursor.desktop --replace-fail "/usr/share/cursor/cursor" "$out/share/cursor/cursor"
 
       wrapProgram $out/bin/cursor \
         --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}} --no-update"
@@ -98,52 +184,7 @@ stdenvNoCC.mkDerivation {
 
   passthru = {
     inherit sources;
-    updateScript = writeScript "update.sh" ''
-      #!/usr/bin/env nix-shell
-      #!nix-shell -i bash -p curl yq coreutils gnused trurl common-updater-scripts
-      set -eu -o pipefail
-
-      baseUrl="https://download.todesktop.com/230313mzl4w4u92"
-      latestLinux="$(curl -s $baseUrl/latest-linux.yml)"
-      latestDarwin="$(curl -s $baseUrl/latest-mac.yml)"
-      linuxVersion="$(echo "$latestLinux" | yq -r .version)"
-
-      currentVersion=$(nix-instantiate --eval -E "with import ./. {}; code-cursor.version or (lib.getVersion code-cursor)" | tr -d '"')
-
-      if [[ "$linuxVersion" != "$currentVersion" ]]; then
-          darwinVersion="$(echo "$latestDarwin" | yq -r .version)"
-          if [ "$linuxVersion" != "$darwinVersion" ]; then
-              echo "Linux version ($linuxVersion) and Darwin version ($darwinVersion) do not match"
-              exit 1
-          fi
-          version="$linuxVersion"
-
-          linuxFilename="$(echo "$latestLinux" | yq -r '.files[] | .url | select(. | endswith(".AppImage"))' | head -n 1)"
-          linuxStem="$(echo "$linuxFilename" | sed -E s/^\(.+build.+\)-[^-]+AppImage$/\\1/)"
-
-          darwinFilename="$(echo "$latestDarwin" | yq -r '.files[] | .url | select(. | endswith(".dmg"))' | head -n 1)"
-          darwinStem="$(echo "$darwinFilename" | sed -E s/^\(.+Build[^-]+\)-.+dmg$/\\1/)"
-
-          for platform in  "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin"; do
-              if [ $platform = "x86_64-linux" ]; then
-                  url="$baseUrl/$linuxStem-x86_64.AppImage"
-              elif [ $platform = "aarch64-linux" ]; then
-                  url="$baseUrl/$linuxStem-arm64.AppImage"
-              elif [ $platform = "x86_64-darwin" ]; then
-                  url="$baseUrl/$darwinStem-x64.dmg"
-              elif [ $platform = "aarch64-darwin" ]; then
-                  url="$baseUrl/$darwinStem-arm64.dmg"
-              else
-                  echo "Unsupported platform: $platform"
-                  exit 1
-              fi
-
-              url=$(trurl --accept-space "$url")
-              hash=$(nix-hash --to-sri --type sha256 "$(nix-prefetch-url "$url" --name "cursor-$version")")
-              update-source-version code-cursor $version $hash $url --system=$platform --ignore-same-version --source-key="sources.$platform"
-          done
-      fi
-    '';
+    updateScript = ./update.sh;
   };
 
   meta = {
@@ -156,7 +197,13 @@ stdenvNoCC.mkDerivation {
       sarahec
       aspauldingcode
     ];
-    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+    platforms = [
+      "x86_64-linux"
+      "x86_64-darwin"
+      "aarch64-darwin"
+    ];
+    # Temporary: Cursor doesn't supply a 0.47.8 build for aarch64-linux
+    badPlatforms = [ "aarch64-linux" ];
     mainProgram = "cursor";
   };
 }
diff --git a/pkgs/by-name/co/code-cursor/update.sh b/pkgs/by-name/co/code-cursor/update.sh
new file mode 100755
index 000000000000..e0ee1c274321
--- /dev/null
+++ b/pkgs/by-name/co/code-cursor/update.sh
@@ -0,0 +1,39 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl yq coreutils common-updater-scripts
+set -eu -o pipefail
+
+currentVersion=$(nix-instantiate --eval -E "with import ./. {}; code-cursor.version or (lib.getVersion code-cursor)" | tr -d '"')
+
+declare -A platforms=( [x86_64-linux]='linux-x64' [aarch64-linux]='linux-arm64' [x86_64-darwin]='darwin-x64' [aarch64-darwin]='darwin-arm64' )
+declare -A updates=( )
+first_version=""
+
+for platform in ${!platforms[@]}; do
+    api_platform=${platforms[$platform]}
+    result=$(curl -s "https://api2.cursor.sh/updates/api/download/stable/$api_platform/cursor")
+    version=$(echo $result | jq -r '.version')
+    if [[ "$version" == "$currentVersion" ]]; then
+      exit 0
+    fi
+    if [[ -z "$first_version" ]]; then
+      first_version=$version
+      first_platform=$platform
+    elif [[ "$version" != "$first_version" ]]; then
+      >&2 echo "Multiple versions found: $first_version ($first_platform) and $version ($platform)"
+      exit 1
+    fi
+    url=$(echo $result | jq -r '.downloadUrl')
+    # Exits with code 22 if not downloadable
+    curl --output /dev/null --silent --head --fail "$url"
+    updates+=( [$platform]="$result" )
+done
+
+# Install updates
+for platform in ${!updates[@]}; do
+  result=${updates[$platform]}
+  version=$(echo $result | jq -r '.version')
+  url=$(echo $result | jq -r '.downloadUrl')
+  source=$(nix-prefetch-url "$url" --name "cursor-$version")
+  hash=$(nix-hash --to-sri --type sha256 "$source")
+  update-source-version code-cursor $version $hash "$url" --system=$platform --ignore-same-version --source-key="sources.$platform"
+done
diff --git a/pkgs/by-name/co/computecpp-unwrapped/package.nix b/pkgs/by-name/co/computecpp-unwrapped/package.nix
index 8ee55d6dde87..0ce9d28d5c56 100644
--- a/pkgs/by-name/co/computecpp-unwrapped/package.nix
+++ b/pkgs/by-name/co/computecpp-unwrapped/package.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
     description = "Accelerate Complex C++ Applications on Heterogeneous Compute Systems using Open Standards";
     homepage = "https://www.codeplay.com/products/computesuite/computecpp";
     license = licenses.unfree;
-    maintainers = with maintainers; [ davidtwco ];
+    maintainers = [ ];
     platforms = [ "x86_64-linux" ];
     sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
   };
diff --git a/pkgs/by-name/de/debos/package.nix b/pkgs/by-name/de/debos/package.nix
new file mode 100644
index 000000000000..5a5c2f0e6f6f
--- /dev/null
+++ b/pkgs/by-name/de/debos/package.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  dpkg,
+  pkg-config,
+  glib,
+  ostree,
+  qemu,
+  unzip,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "debos";
+  version = "1.1.5";
+
+  src = fetchFromGitHub {
+    owner = "go-debos";
+    repo = "debos";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-1Xv7r1uyISp1whALtFZWNQgTMH0swd/0+QdRCmXM4DQ=";
+  };
+
+  vendorHash = "sha256-FdcmitxGKzkHqFjllDGW24Lr8yrsYDBzuEDRco9CW14=";
+
+  nativeBuildInputs = [
+    dpkg
+    pkg-config
+    unzip
+  ];
+
+  buildInputs = [
+    glib
+    ostree
+    qemu
+  ];
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Tool to create Debian OS images";
+    homepage = "https://github.com/go-debos/debos";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ liberodark ];
+    mainProgram = "debos";
+  };
+})
diff --git a/pkgs/by-name/do/doctest/package.nix b/pkgs/by-name/do/doctest/package.nix
index 11ad954f6b76..793a4af00f58 100644
--- a/pkgs/by-name/do/doctest/package.nix
+++ b/pkgs/by-name/do/doctest/package.nix
@@ -35,6 +35,6 @@ stdenv.mkDerivation rec {
     description = "Fastest feature-rich C++11/14/17/20 single-header testing framework";
     platforms = platforms.all;
     license = licenses.mit;
-    maintainers = with maintainers; [ davidtwco ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/by-name/du/duckdb/versions.json b/pkgs/by-name/du/duckdb/versions.json
index bfe1c0f12964..071631c3216b 100644
--- a/pkgs/by-name/du/duckdb/versions.json
+++ b/pkgs/by-name/du/duckdb/versions.json
@@ -1,5 +1,5 @@
 {
-  "version": "1.2.0",
-  "rev": "5f5512b827df6397afd31daedb4bbdee76520019",
-  "hash": "sha256-93iBUsNKXRGdnN1ZRSWJfnSNM23U/M0sudgHk6HGIhM="
+  "version": "1.2.1",
+  "rev": "8e52ec43959ab363643d63cb78ee214577111da4",
+  "hash": "sha256-ez5BBZ+Yw+UkdpI3VvRZrYZPfk3Nkk3JmrJBdg8N+e0="
 }
diff --git a/pkgs/by-name/fl/flawz/package.nix b/pkgs/by-name/fl/flawz/package.nix
index be3025166951..3e7ffcc60516 100644
--- a/pkgs/by-name/fl/flawz/package.nix
+++ b/pkgs/by-name/fl/flawz/package.nix
@@ -75,6 +75,5 @@ rustPlatform.buildRustPackage rec {
     mainProgram = "flawz";
     maintainers = with lib.maintainers; [ anas ];
     platforms = with lib.platforms; unix ++ windows;
-    broken = stdenv.hostPlatform.isDarwin; # needing some apple_sdk packages
   };
 }
diff --git a/pkgs/by-name/go/go-critic/package.nix b/pkgs/by-name/go/go-critic/package.nix
index 3b6ddf5cb88b..767e4e85b136 100644
--- a/pkgs/by-name/go/go-critic/package.nix
+++ b/pkgs/by-name/go/go-critic/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "go-critic";
-  version = "0.12.0";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "go-critic";
     repo = "go-critic";
     rev = "v${version}";
-    hash = "sha256-iGJ2GPag79HSdwCJOuUn86fEe1/NhmPXVRCCYeWokGw=";
+    hash = "sha256-0AOhq7OhSHub4I6XXL018hg6i2ERkIbZCrO9osNjvHw=";
   };
 
-  vendorHash = "sha256-DhjXu/9Cv/pcBuC83Hc2PpgvN9k445WOr1IBkxtmQlw=";
+  vendorHash = "sha256-yTm5Hhqbk1aJ4ZAR+ie2NnDOAGpjijUKQxZW3Tp9bs8=";
 
   subPackages = [
     "cmd/gocritic"
diff --git a/pkgs/by-name/go/gopls/package.nix b/pkgs/by-name/go/gopls/package.nix
index d354a3e68ec6..c0200f76c20b 100644
--- a/pkgs/by-name/go/gopls/package.nix
+++ b/pkgs/by-name/go/gopls/package.nix
@@ -2,16 +2,18 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  nix-update-script,
+  versionCheckHook,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "gopls";
   version = "0.18.1";
 
   src = fetchFromGitHub {
     owner = "golang";
     repo = "tools";
-    rev = "gopls/v${version}";
+    tag = "gopls/v${finalAttrs.version}";
     hash = "sha256-5w6R3kaYwrZyhIYjwLqfflboXT/z3HVpZiowxeUyaWg=";
   };
 
@@ -19,7 +21,7 @@ buildGoModule rec {
   vendorHash = "sha256-/tca93Df90/8K1dqhOfUsWSuFoNfg9wdWy3csOtFs6Y=";
 
   # https://github.com/golang/tools/blob/9ed98faa/gopls/main.go#L27-L30
-  ldflags = [ "-X main.version=v${version}" ];
+  ldflags = [ "-X main.version=v${finalAttrs.version}" ];
 
   doCheck = false;
 
@@ -30,12 +32,18 @@ buildGoModule rec {
     "internal/analysis/modernize/cmd/modernize"
   ];
 
-  meta = with lib; {
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "version";
+
+  passthru.updateScript = nix-update-script { extraArgs = [ "--version-regex=gopls/(.*)" ]; };
+
+  meta = {
+    changelog = "https://github.com/golang/tools/releases/tag/gopls/v${finalAttrs.version}";
     description = "Official language server for the Go language";
     homepage = "https://github.com/golang/tools/tree/master/gopls";
-    changelog = "https://github.com/golang/tools/releases/tag/${src.rev}";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [
       mic92
       rski
       SuperSandro2000
@@ -43,4 +51,4 @@ buildGoModule rec {
     ];
     mainProgram = "gopls";
   };
-}
+})
diff --git a/pkgs/by-name/hy/hyprland/info.json b/pkgs/by-name/hy/hyprland/info.json
index f01f9233f05e..ad4f188f971b 100644
--- a/pkgs/by-name/hy/hyprland/info.json
+++ b/pkgs/by-name/hy/hyprland/info.json
@@ -1,7 +1,7 @@
 {
-  "branch": "main",
-  "commit_hash": "5ee35f914f921e5696030698e74fb5566a804768",
-  "commit_message": "version: bump to 0.48.0",
-  "date": "2025-03-23",
-  "tag": "v0.48.0"
+  "branch": "v0.48.1-b",
+  "commit_hash": "29e2e59fdbab8ed2cc23a20e3c6043d5decb5cdc",
+  "commit_message": "version: bump to v0.48.1",
+  "date": "2025-03-28",
+  "tag": "v0.48.1"
 }
diff --git a/pkgs/by-name/hy/hyprland/package.nix b/pkgs/by-name/hy/hyprland/package.nix
index 59b7302af842..e2714aa085d7 100644
--- a/pkgs/by-name/hy/hyprland/package.nix
+++ b/pkgs/by-name/hy/hyprland/package.nix
@@ -86,14 +86,14 @@ assert assertMsg (!hidpiXWayland)
 
 customStdenv.mkDerivation (finalAttrs: {
   pname = "hyprland" + optionalString debug "-debug";
-  version = "0.48.0";
+  version = "0.48.1";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "hyprland";
     fetchSubmodules = true;
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QfXnNrQSa9xDrlzl/dJvsFgMmPECveyU/7cKJ2YyIzI=";
+    hash = "sha256-skuJFly6LSFfyAVy2ByNolkEwIijsTu2TxzQ9ugWarI=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/ia/iam-policy-json-to-terraform/package.nix b/pkgs/by-name/ia/iam-policy-json-to-terraform/package.nix
index d8bca4f7d1ea..9d33fa0d6440 100644
--- a/pkgs/by-name/ia/iam-policy-json-to-terraform/package.nix
+++ b/pkgs/by-name/ia/iam-policy-json-to-terraform/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "iam-policy-json-to-terraform";
-  version = "1.8.2";
+  version = "1.9.1";
 
   src = fetchFromGitHub {
     owner = "flosell";
     repo = pname;
     rev = version;
-    sha256 = "sha256-ovmWZpeHt1L8zNzG7+2BohteSjpYADMivi+AP0Vm8/E=";
+    sha256 = "sha256-xIhe+Mnvog+xRu1qMA7yxS1pCs91cr5EcaJroO+0zJ8=";
   };
 
-  vendorHash = "sha256-1WTc7peTJI3IvHJqznqRz29uQ2NG0CZpAAzlyYymZCQ=";
+  vendorHash = "sha256-6EtOMs+Vba39hOQ029dHpHCJ9ke35PZ/em9Xye3dmvg=";
 
   meta = with lib; {
     description = "Small tool to convert an IAM Policy in JSON format into a Terraform aws_iam_policy_document";
diff --git a/pkgs/by-name/in/inv-sig-helper/package.nix b/pkgs/by-name/in/inv-sig-helper/package.nix
index f949fb24f871..32c722b7153d 100644
--- a/pkgs/by-name/in/inv-sig-helper/package.nix
+++ b/pkgs/by-name/in/inv-sig-helper/package.nix
@@ -16,13 +16,13 @@
 
 rustPlatform.buildRustPackage {
   pname = "inv-sig-helper";
-  version = "0-unstable-2025-03-25";
+  version = "0-unstable-2025-03-27";
 
   src = fetchFromGitHub {
     owner = "iv-org";
     repo = "inv_sig_helper";
-    rev = "318e555b2b08921ec9262ef5b269548f0e806834";
-    hash = "sha256-NgowxT2EuOQxUvW5niM7rtNkdSkadlsiiOiqb9JDjdE=";
+    rev = "1c70bf6375d9f31a459d8d1e409dd3fb5d5f175c";
+    hash = "sha256-MGU7MXFZkJjM0OGiqxs2RQGbPaiRB23w78iZKSo/4hk=";
   };
 
   useFetchCargoVendor = true;
diff --git a/pkgs/by-name/ji/jirafeau/package.nix b/pkgs/by-name/ji/jirafeau/package.nix
index 8b38fb606189..33cc8d383e59 100644
--- a/pkgs/by-name/ji/jirafeau/package.nix
+++ b/pkgs/by-name/ji/jirafeau/package.nix
@@ -36,6 +36,6 @@ stdenv.mkDerivation rec {
     license = licenses.agpl3Plus;
     homepage = "https://gitlab.com/mojo42/Jirafeau";
     platforms = platforms.all;
-    maintainers = with maintainers; [ davidtwco ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/by-name/kh/khronos-ocl-icd-loader/package.nix b/pkgs/by-name/kh/khronos-ocl-icd-loader/package.nix
index 51a110917758..60fb02025d95 100644
--- a/pkgs/by-name/kh/khronos-ocl-icd-loader/package.nix
+++ b/pkgs/by-name/kh/khronos-ocl-icd-loader/package.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     mainProgram = "cllayerinfo";
     homepage = "https://github.com/KhronosGroup/OpenCL-ICD-Loader";
     license = licenses.asl20;
-    maintainers = with maintainers; [ davidtwco ];
+    maintainers = [ ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/by-name/lt/lttoolbox/package.nix b/pkgs/by-name/lt/lttoolbox/package.nix
index b4b8cba30a7a..48db7dcea516 100644
--- a/pkgs/by-name/lt/lttoolbox/package.nix
+++ b/pkgs/by-name/lt/lttoolbox/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   fetchFromGitHub,
   fetchpatch,
+  autoreconfHook,
   autoconf,
   automake,
   pkg-config,
@@ -15,25 +16,17 @@
 
 stdenv.mkDerivation rec {
   pname = "lttoolbox";
-  version = "3.7.1";
+  version = "3.7.6";
 
   src = fetchFromGitHub {
     owner = "apertium";
     repo = "lttoolbox";
     tag = "v${version}";
-    hash = "sha256-3lHXKtwQSrMGQEGOGr27e3kB2qKkTFZcEzeAnIm89Rg=";
+    hash = "sha256-T92TEhrWwPYW8e49rc0jfM0C3dmNYtuexhO/l5s+tQ0=";
   };
 
-  patches = [
-    # can be removed once the version goes past this commit
-    # https://github.com/apertium/lttoolbox/commit/e682fe18a96d5a865cfbd3e5661dbc7b3ace1821
-    (fetchpatch {
-      url = "https://github.com/apertium/lttoolbox/commit/e682fe18a96d5a865cfbd3e5661dbc7b3ace1821.patch";
-      hash = "sha256-VeP8Mv2KYxX+eVjIRw/jHbURaWN665+fiFaoT3VxAno=";
-    })
-  ];
-
   nativeBuildInputs = [
+    autoreconfHook
     autoconf
     automake
     pkg-config
@@ -47,12 +40,11 @@ stdenv.mkDerivation rec {
   buildFlags = [
     "CPPFLAGS=-I${utf8cpp}/include/utf8cpp"
   ];
-  configurePhase = ''
-    ./autogen.sh --prefix $out
-  '';
+
+  nativeCheckInputs = [ python3 ];
   doCheck = true;
   checkPhase = ''
-    ${python3}/bin/python3 tests/run_tests.py
+    python3 tests/run_tests.py
   '';
 
   meta = with lib; {
diff --git a/pkgs/by-name/ly/lyra/package.nix b/pkgs/by-name/ly/lyra/package.nix
index b9718c7749a0..a52e8896e9e4 100644
--- a/pkgs/by-name/ly/lyra/package.nix
+++ b/pkgs/by-name/ly/lyra/package.nix
@@ -34,6 +34,6 @@ stdenv.mkDerivation rec {
     description = "Simple to use, composable, command line parser for C++ 11 and beyond";
     platforms = platforms.unix;
     license = licenses.boost;
-    maintainers = with maintainers; [ davidtwco ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/by-name/ne/neovim-unwrapped/package.nix b/pkgs/by-name/ne/neovim-unwrapped/package.nix
index abacc9f3c53d..6c26e4d1a646 100644
--- a/pkgs/by-name/ne/neovim-unwrapped/package.nix
+++ b/pkgs/by-name/ne/neovim-unwrapped/package.nix
@@ -4,13 +4,11 @@
   fetchFromGitHub,
   cmake,
   gettext,
-  msgpack-c,
   libuv,
   lua,
   pkg-config,
   unibilium,
   utf8proc,
-  libvterm-neovim,
   tree-sitter,
   fetchurl,
   buildPackages,
@@ -135,13 +133,11 @@ stdenv.mkDerivation (
     buildInputs =
       [
         libuv
-        libvterm-neovim
         # This is actually a c library, hence it's not included in neovimLuaEnv,
         # see:
         # https://github.com/luarocks/luarocks/issues/1402#issuecomment-1080616570
         # and it's definition at: pkgs/development/lua-modules/overrides.nix
         lua.pkgs.libluv
-        msgpack-c
         neovimLuaEnv
         tree-sitter
         unibilium
@@ -201,6 +197,7 @@ stdenv.mkDerivation (
         # That's because all dependencies were found and
         # third-party/CMakeLists.txt is not read at all.
         (lib.cmakeBool "USE_BUNDLED" false)
+        (lib.cmakeBool "ENABLE_TRANSLATIONS" true)
       ]
       ++ (
         if lua.pkgs.isLuaJIT then
diff --git a/pkgs/by-name/nh/nhost-cli/package.nix b/pkgs/by-name/nh/nhost-cli/package.nix
index 459bd6457c7f..d6f2a91f72f1 100644
--- a/pkgs/by-name/nh/nhost-cli/package.nix
+++ b/pkgs/by-name/nh/nhost-cli/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "nhost-cli";
-  version = "1.29.4";
+  version = "1.29.5";
 
   src = fetchFromGitHub {
     owner = "nhost";
     repo = "cli";
     tag = "v${version}";
-    hash = "sha256-5fi+k+xmjswGl3Mx81ieZT/i62A+fRn/+37npsse3wk=";
+    hash = "sha256-x6/hPW8sD/wwgjlA6+Cz3t3c7KICD/bhzz5yfks/In8=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/op/opener/package.nix b/pkgs/by-name/op/opener/package.nix
index bc51a1e6062f..e4e2c15d387e 100644
--- a/pkgs/by-name/op/opener/package.nix
+++ b/pkgs/by-name/op/opener/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "opener";
-  version = "0.1.5";
+  version = "0.1.6";
 
   src = fetchFromGitHub {
     owner = "superbrothers";
     repo = "opener";
     tag = "v${version}";
-    hash = "sha256-pp2jn4J6gYyZky5rVBaai9sVVqvPgM+fGryseM58WEI=";
+    hash = "sha256-rYeQ45skFXWxdxMj0dye8IBEYcQCRqdt9nLVXF36od8=";
   };
 
-  vendorHash = "sha256-xwMRWEwrG12QevVVTMC9OTdjIBoxR1AHkoa6OErPpF4=";
+  vendorHash = "sha256-lju+QlWxUb11UV9NvXSgQ+ZG37WhyZVahJTM5voDEfw=";
 
   postPatch = ''
     substituteInPlace opener.go \
diff --git a/pkgs/by-name/pu/pulumi/extra/mk-pulumi-package.nix b/pkgs/by-name/pu/pulumi/extra/mk-pulumi-package.nix
new file mode 100644
index 000000000000..9981bb8d2251
--- /dev/null
+++ b/pkgs/by-name/pu/pulumi/extra/mk-pulumi-package.nix
@@ -0,0 +1,187 @@
+{
+  buildGoModule,
+  fetchFromGitHub,
+  python3Packages,
+}:
+let
+  mkBasePackage =
+    {
+      pname,
+      src,
+      version,
+      vendorHash,
+      cmd,
+      extraLdflags,
+      env,
+      ...
+    }@args:
+    buildGoModule (
+      rec {
+        inherit
+          pname
+          src
+          vendorHash
+          version
+          env
+          ;
+
+        sourceRoot = "${src.name}/provider";
+
+        subPackages = [ "cmd/${cmd}" ];
+
+        doCheck = false;
+
+        ldflags = [
+          "-s"
+          "-w"
+        ] ++ extraLdflags;
+      }
+      // args
+    );
+
+  mkPythonPackage =
+    {
+      meta,
+      pname,
+      src,
+      version,
+      ...
+    }:
+    python3Packages.callPackage (
+      {
+        buildPythonPackage,
+        pythonOlder,
+        parver,
+        pip,
+        pulumi,
+        semver,
+        setuptools,
+      }:
+      buildPythonPackage {
+        inherit
+          pname
+          meta
+          src
+          version
+          ;
+        format = "pyproject";
+
+        disabled = pythonOlder "3.7";
+
+        sourceRoot = "${src.name}/sdk/python";
+
+        propagatedBuildInputs = [
+          parver
+          pulumi
+          semver
+          setuptools
+        ];
+
+        postPatch = ''
+          if [[ -e "pyproject.toml" ]]; then
+            sed -i \
+              -e 's/^  version = .*/  version = "${version}"/g' \
+              pyproject.toml
+          else
+            sed -i \
+               -e 's/^VERSION = .*/VERSION = "${version}"/g' \
+               -e 's/^PLUGIN_VERSION = .*/PLUGIN_VERSION = "${version}"/g' \
+               setup.py
+          fi
+        '';
+
+        # Auto-generated; upstream does not have any tests.
+        # Verify that the version substitution works
+        checkPhase = ''
+          runHook preCheck
+
+          ${pip}/bin/pip show "${pname}" | grep "Version: ${version}" > /dev/null \
+            || (echo "ERROR: Version substitution seems to be broken"; exit 1)
+
+          runHook postCheck
+        '';
+
+        pythonImportsCheck = [
+          (builtins.replaceStrings [ "-" ] [ "_" ] pname)
+        ];
+      }
+    ) { };
+in
+{
+  owner,
+  repo,
+  rev,
+  version,
+  hash,
+  vendorHash,
+  cmdGen,
+  cmdRes,
+  extraLdflags,
+  env ? { },
+  meta,
+  fetchSubmodules ? false,
+  ...
+}@args:
+let
+  src = fetchFromGitHub {
+    name = "source-${repo}-${rev}";
+    inherit
+      owner
+      repo
+      rev
+      hash
+      fetchSubmodules
+      ;
+  };
+
+  pulumi-gen = mkBasePackage rec {
+    inherit
+      src
+      version
+      vendorHash
+      extraLdflags
+      env
+      ;
+
+    cmd = cmdGen;
+    pname = cmdGen;
+  };
+in
+mkBasePackage (
+  {
+    inherit
+      meta
+      src
+      version
+      vendorHash
+      extraLdflags
+      env
+      ;
+
+    pname = repo;
+
+    nativeBuildInputs = [
+      pulumi-gen
+    ];
+
+    cmd = cmdRes;
+
+    postConfigure = ''
+      pushd ..
+
+      chmod +w sdk/
+      ${cmdGen} schema
+
+      popd
+
+      VERSION=v${version} go generate cmd/${cmdRes}/main.go
+    '';
+
+    passthru.sdks.python = mkPythonPackage {
+      inherit meta src version;
+
+      pname = repo;
+    };
+  }
+  // args
+)
diff --git a/pkgs/by-name/pu/pulumi/extra/pulumi-test-hook.sh b/pkgs/by-name/pu/pulumi/extra/pulumi-test-hook.sh
new file mode 100644
index 000000000000..f62a9418c46c
--- /dev/null
+++ b/pkgs/by-name/pu/pulumi/extra/pulumi-test-hook.sh
@@ -0,0 +1,15 @@
+# shellcheck shell=bash
+
+appendToVar preCheckHooks pulumiTestHook
+
+pulumiTestHook() {
+    local tmpdir
+    tmpdir=$(mktemp -d)
+    export USER=${USER-nixbld} HOME=${HOME-$tmpdir}
+    export PULUMI_HOME=$tmpdir/.pulumi
+    export PULUMI_CONFIG_PASSPHRASE=5up3r53cr37
+    export PULUMI_SKIP_UPDATE_CHECK=1
+    export PULUMI_DISABLE_AUTOMATIC_PLUGIN_ACQUISITION=1
+    pulumi login "file://$tmpdir"
+    pulumi stack init -- "${pulumiStackName-nixpkgs}"
+}
diff --git a/pkgs/by-name/pu/pulumi/extra/test-resource-schema.nix b/pkgs/by-name/pu/pulumi/extra/test-resource-schema.nix
new file mode 100644
index 000000000000..99ca01b0b7bf
--- /dev/null
+++ b/pkgs/by-name/pu/pulumi/extra/test-resource-schema.nix
@@ -0,0 +1,35 @@
+{
+  lib,
+  runCommand,
+  pulumi,
+  jq,
+}:
+{
+  package,
+  name ? lib.removePrefix "pulumi-" (lib.getName package),
+  version ? lib.getVersion package,
+}:
+runCommand "pulumi-resource-${name}-schema-version-check"
+  {
+    resourceName = name;
+    expectedVersion = if version != null then version else "null";
+    nativeBuildInputs = [
+      jq
+      pulumi
+      package
+    ];
+    env = {
+      PULUMI_SKIP_UPDATE_CHECK = "1";
+      PULUMI_DISABLE_AUTOMATIC_PLUGIN_ACQUISITION = "1";
+    };
+    __darwinAllowLocalNetworking = true;
+    meta.timeout = 120;
+  }
+  ''
+    actualVersion=$(pulumi package get-schema -- "$resourceName" | jq -j .version)
+    if [[ $expectedVersion != "$actualVersion" ]]; then
+      echo "Expected schema version $expectedVersion, but got $actualVersion" >&2
+      false
+    fi
+    mkdir -p "$out"
+  ''
diff --git a/pkgs/by-name/pu/pulumi/package.nix b/pkgs/by-name/pu/pulumi/package.nix
index a7eaaf051273..219a23859dec 100644
--- a/pkgs/by-name/pu/pulumi/package.nix
+++ b/pkgs/by-name/pu/pulumi/package.nix
@@ -7,11 +7,9 @@
   git,
   buildPackages,
   # passthru
-  runCommand,
-  makeWrapper,
+  callPackage,
   testers,
   pulumi,
-  pulumiPackages,
 }:
 buildGoModule rec {
   pname = "pulumi";
@@ -117,25 +115,18 @@ buildGoModule rec {
   '';
 
   passthru = {
-    pkgs = pulumiPackages;
-    withPackages =
-      f:
-      runCommand "${pulumi.name}-with-packages"
-        {
-          nativeBuildInputs = [ makeWrapper ];
-        }
-        ''
-          mkdir -p $out/bin
-          makeWrapper ${pulumi}/bin/pulumi $out/bin/pulumi \
-            --suffix PATH : ${lib.makeBinPath (f pulumiPackages)} \
-            --set LD_LIBRARY_PATH "${lib.getLib stdenv.cc.cc}/lib"
-        '';
+    pkgs = callPackage ./plugins.nix { };
+    withPackages = callPackage ./with-packages.nix { };
     tests = {
       version = testers.testVersion {
         package = pulumi;
         version = "v${version}";
         command = "PULUMI_SKIP_UPDATE_CHECK=1 pulumi version";
       };
+      pulumiTestHookShellcheck = testers.shellcheck {
+        name = "pulumi-test-hook-shellcheck";
+        src = ./extra/pulumi-test-hook.sh;
+      };
     };
   };
 
diff --git a/pkgs/by-name/pu/pulumi/plugins.nix b/pkgs/by-name/pu/pulumi/plugins.nix
new file mode 100644
index 000000000000..194d8483c1e5
--- /dev/null
+++ b/pkgs/by-name/pu/pulumi/plugins.nix
@@ -0,0 +1,26 @@
+{
+  lib,
+  config,
+  generateSplicesForMkScope,
+  makeScopeWithSplicing',
+  attributePathToSplice ? [ "pulumiPackages" ],
+}:
+makeScopeWithSplicing' {
+  otherSplices = generateSplicesForMkScope attributePathToSplice;
+  extra = self: {
+    mkPulumiPackage = self.callPackage ./extra/mk-pulumi-package.nix { };
+    testResourceSchema = self.callPackage ./extra/test-resource-schema.nix { };
+    pulumiTestHook = ./extra/pulumi-test-hook.sh;
+  };
+  f =
+    self:
+    lib.packagesFromDirectoryRecursive {
+      inherit (self) callPackage;
+      directory = ./plugins;
+    }
+    // lib.optionalAttrs config.allowAliases {
+      pulumi-language-go = lib.warnOnInstantiate "pulumi-language-go has been renamed to pulumi-go" self.pulumi-go;
+      pulumi-language-nodejs = lib.warnOnInstantiate "pulumi-language-nodejs has been renamed to pulumi-nodejs" self.pulumi-nodejs;
+      pulumi-language-python = lib.warnOnInstantiate "pulumi-language-python has been renamed to pulumi-python" self.pulumi-python;
+    };
+}
diff --git a/pkgs/tools/admin/pulumi-packages/pulumi-aws-native.nix b/pkgs/by-name/pu/pulumi/plugins/pulumi-aws-native/package.nix
similarity index 100%
rename from pkgs/tools/admin/pulumi-packages/pulumi-aws-native.nix
rename to pkgs/by-name/pu/pulumi/plugins/pulumi-aws-native/package.nix
diff --git a/pkgs/tools/admin/pulumi-packages/pulumi-azure-native.nix b/pkgs/by-name/pu/pulumi/plugins/pulumi-azure-native/package.nix
similarity index 100%
rename from pkgs/tools/admin/pulumi-packages/pulumi-azure-native.nix
rename to pkgs/by-name/pu/pulumi/plugins/pulumi-azure-native/package.nix
diff --git a/pkgs/tools/admin/pulumi-packages/pulumi-command.nix b/pkgs/by-name/pu/pulumi/plugins/pulumi-command/package.nix
similarity index 100%
rename from pkgs/tools/admin/pulumi-packages/pulumi-command.nix
rename to pkgs/by-name/pu/pulumi/plugins/pulumi-command/package.nix
diff --git a/pkgs/tools/admin/pulumi-packages/pulumi-language-go.nix b/pkgs/by-name/pu/pulumi/plugins/pulumi-go/package.nix
similarity index 96%
rename from pkgs/tools/admin/pulumi-packages/pulumi-language-go.nix
rename to pkgs/by-name/pu/pulumi/plugins/pulumi-go/package.nix
index eb6094277569..a7371c0e6b67 100644
--- a/pkgs/tools/admin/pulumi-packages/pulumi-language-go.nix
+++ b/pkgs/by-name/pu/pulumi/plugins/pulumi-go/package.nix
@@ -4,7 +4,7 @@
   pulumi,
 }:
 buildGoModule rec {
-  pname = "pulumi-language-go";
+  pname = "pulumi-go";
   inherit (pulumi) version src;
 
   sourceRoot = "${src.name}/sdk/go/pulumi-language-go";
diff --git a/pkgs/tools/admin/pulumi-packages/pulumi-hcloud.nix b/pkgs/by-name/pu/pulumi/plugins/pulumi-hcloud/package.nix
similarity index 100%
rename from pkgs/tools/admin/pulumi-packages/pulumi-hcloud.nix
rename to pkgs/by-name/pu/pulumi/plugins/pulumi-hcloud/package.nix
diff --git a/pkgs/tools/admin/pulumi-packages/pulumi-language-nodejs.nix b/pkgs/by-name/pu/pulumi/plugins/pulumi-nodejs/package.nix
similarity index 97%
rename from pkgs/tools/admin/pulumi-packages/pulumi-language-nodejs.nix
rename to pkgs/by-name/pu/pulumi/plugins/pulumi-nodejs/package.nix
index 835e46e43c9d..c3dd0f050239 100644
--- a/pkgs/tools/admin/pulumi-packages/pulumi-language-nodejs.nix
+++ b/pkgs/by-name/pu/pulumi/plugins/pulumi-nodejs/package.nix
@@ -7,7 +7,7 @@
   python3,
 }:
 buildGoModule rec {
-  pname = "pulumi-language-nodejs";
+  pname = "pulumi-nodejs";
   inherit (pulumi) version src;
 
   sourceRoot = "${src.name}/sdk/nodejs/cmd/pulumi-language-nodejs";
diff --git a/pkgs/tools/admin/pulumi-packages/pulumi-language-python.nix b/pkgs/by-name/pu/pulumi/plugins/pulumi-python/package.nix
similarity index 90%
rename from pkgs/tools/admin/pulumi-packages/pulumi-language-python.nix
rename to pkgs/by-name/pu/pulumi/plugins/pulumi-python/package.nix
index 45a346cd0bf3..74ff53ad2b08 100644
--- a/pkgs/tools/admin/pulumi-packages/pulumi-language-python.nix
+++ b/pkgs/by-name/pu/pulumi/plugins/pulumi-python/package.nix
@@ -1,12 +1,13 @@
 {
   lib,
   buildGoModule,
+  callPackage,
   pulumi,
   bash,
   python3,
 }:
 buildGoModule rec {
-  pname = "pulumi-language-python";
+  pname = "pulumi-python";
   inherit (pulumi) version src;
 
   sourceRoot = "${src.name}/sdk/python/cmd/pulumi-language-python";
@@ -45,6 +46,8 @@ buildGoModule rec {
       ../../dist/pulumi-analyzer-policy-python
   '';
 
+  passthru.tests.smokeTest = callPackage ./smoke-test/default.nix { };
+
   meta = {
     homepage = "https://www.pulumi.com/docs/iac/languages-sdks/python/";
     description = "Language host for Pulumi programs written in Python";
diff --git a/pkgs/by-name/pu/pulumi/plugins/pulumi-python/smoke-test/Pulumi.yaml b/pkgs/by-name/pu/pulumi/plugins/pulumi-python/smoke-test/Pulumi.yaml
new file mode 100644
index 000000000000..94072ba5e3aa
--- /dev/null
+++ b/pkgs/by-name/pu/pulumi/plugins/pulumi-python/smoke-test/Pulumi.yaml
@@ -0,0 +1,2 @@
+name: smoke-test
+runtime: python
diff --git a/pkgs/by-name/pu/pulumi/plugins/pulumi-python/smoke-test/__main__.py b/pkgs/by-name/pu/pulumi/plugins/pulumi-python/smoke-test/__main__.py
new file mode 100644
index 000000000000..43b7d1a8e895
--- /dev/null
+++ b/pkgs/by-name/pu/pulumi/plugins/pulumi-python/smoke-test/__main__.py
@@ -0,0 +1,18 @@
+from binascii import b2a_hex
+from os import urandom
+
+from pulumi import export, ResourceOptions
+from pulumi.dynamic import Resource, ResourceProvider, CreateResult
+
+
+class RandomProvider(ResourceProvider):
+    def create(self, inputs):
+        return CreateResult(b2a_hex(urandom(16)), outs={})
+
+
+class Random(Resource):
+    def __init__(self, name, opts = None):
+         super().__init__(RandomProvider(), name, {}, opts)
+
+
+export("out", Random(name="random_test").id)
diff --git a/pkgs/by-name/pu/pulumi/plugins/pulumi-python/smoke-test/default.nix b/pkgs/by-name/pu/pulumi/plugins/pulumi-python/smoke-test/default.nix
new file mode 100644
index 000000000000..903461878342
--- /dev/null
+++ b/pkgs/by-name/pu/pulumi/plugins/pulumi-python/smoke-test/default.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  stdenvNoCC,
+  pulumiTestHook,
+  pulumi,
+  pulumi-python,
+  python3Packages,
+}:
+stdenvNoCC.mkDerivation {
+  name = "pulumi-python-smoke-test";
+  src = builtins.filterSource (name: _: !(lib.hasSuffix ".nix" name)) ./.;
+
+  doCheck = true;
+
+  nativeCheckInputs = [
+    pulumiTestHook
+    pulumi
+    pulumi-python
+    python3Packages.pulumi
+  ];
+
+  __darwinAllowLocalNetworking = true;
+
+  checkPhase = ''
+    runHook preCheck
+    pulumi update --skip-preview
+    stackOutput=$(pulumi stack output out)
+    [[ $stackOutput =~ ^[0-9a-f]{32}$ ]]
+    runHook postCheck
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p "$out"
+    runHook postInstall
+  '';
+}
diff --git a/pkgs/tools/admin/pulumi-packages/pulumi-random.nix b/pkgs/by-name/pu/pulumi/plugins/pulumi-random/package.nix
similarity index 100%
rename from pkgs/tools/admin/pulumi-packages/pulumi-random.nix
rename to pkgs/by-name/pu/pulumi/plugins/pulumi-random/package.nix
diff --git a/pkgs/tools/admin/pulumi-packages/pulumi-yandex-unofficial.nix b/pkgs/by-name/pu/pulumi/plugins/pulumi-yandex-unofficial/package.nix
similarity index 100%
rename from pkgs/tools/admin/pulumi-packages/pulumi-yandex-unofficial.nix
rename to pkgs/by-name/pu/pulumi/plugins/pulumi-yandex-unofficial/package.nix
diff --git a/pkgs/by-name/pu/pulumi/with-packages.nix b/pkgs/by-name/pu/pulumi/with-packages.nix
new file mode 100644
index 000000000000..68b98228fce9
--- /dev/null
+++ b/pkgs/by-name/pu/pulumi/with-packages.nix
@@ -0,0 +1,35 @@
+{
+  lib,
+  runCommand,
+  pulumi,
+  pulumiPackages,
+  makeBinaryWrapper,
+}:
+f:
+# Note that Pulumi prints a warning for “ambient” plugins (i.e. from PATH). E.g.
+#   warning: using pulumi-resource-* from $PATH at /nix/store/*
+# See also https://github.com/pulumi/pulumi/issues/14525
+#
+# We can install packages alongside pulumi executable, but that would only
+# suppress the warning for packages that are bundled with the official
+# distribution. Refer to the implementation of workspace.IsPluginBundled:
+# https://pkg.go.dev/github.com/pulumi/pulumi/sdk/v3@v3.150.0/go/common/workspace#IsPluginBundled
+# https://github.com/pulumi/pulumi/blob/v3.150.0/sdk/go/common/workspace/plugins.go#L2202-L2210
+runCommand "pulumi-with-packages"
+  {
+    inherit pulumi;
+    makeWrapperArgs = [
+      "--suffix"
+      "PATH"
+      ":"
+      (lib.makeBinPath (f pulumiPackages))
+    ];
+    __structuredAttrs = true;
+    nativeBuildInputs = [ makeBinaryWrapper ];
+    meta.mainProgram = "pulumi";
+  }
+  ''
+    mkdir -p "$out/bin"
+    ln -s -t "$out" "$pulumi/share"
+    makeWrapper "$pulumi/bin/pulumi" "$out/bin/pulumi" "''${makeWrapperArgs[@]}"
+  ''
diff --git a/pkgs/by-name/qu/quarkus/package.nix b/pkgs/by-name/qu/quarkus/package.nix
index 655a36f50566..9c3a110d5823 100644
--- a/pkgs/by-name/qu/quarkus/package.nix
+++ b/pkgs/by-name/qu/quarkus/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "quarkus-cli";
-  version = "3.19.3";
+  version = "3.19.4";
 
   src = fetchurl {
     url = "https://github.com/quarkusio/quarkus/releases/download/${finalAttrs.version}/quarkus-cli-${finalAttrs.version}.tar.gz";
-    hash = "sha256-Vz+L3wB7IjfCw47ZHMyD2LnonoUbSAFS5byQ5DylUCo=";
+    hash = "sha256-18sfx0z06JqdYFfSNT62X9Io6awPxUNzjKmG/PeaDB0=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/sa/saw-tools/package.nix b/pkgs/by-name/sa/saw-tools/package.nix
index bd0f2d31f885..ca7f31669d94 100644
--- a/pkgs/by-name/sa/saw-tools/package.nix
+++ b/pkgs/by-name/sa/saw-tools/package.nix
@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "saw-tools";
-  version = "1.2";
+  version = "1.3";
 
   src = fetchurl {
     url = "https://github.com/GaloisInc/saw-script/releases/download/v${finalAttrs.version}/saw-${finalAttrs.version}-ubuntu-22.04-X64-with-solvers.tar.gz";
-    hash = "sha256-A99BCiVV5Ep/PL7VSDNYcvr177Q+FKdDrxhFJLW/iU4=";
+    hash = "sha256-1t1uGAQXCBC//RNBxQfZIfg00At600An9HaEIcVBEy0=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/ss/ssh-to-age/package.nix b/pkgs/by-name/ss/ssh-to-age/package.nix
index 7393c859f69b..db0e49155c7d 100644
--- a/pkgs/by-name/ss/ssh-to-age/package.nix
+++ b/pkgs/by-name/ss/ssh-to-age/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "ssh-to-age";
-  version = "1.1.10";
+  version = "1.1.11";
 
   src = fetchFromGitHub {
     owner = "Mic92";
     repo = "ssh-to-age";
     rev = version;
-    sha256 = "sha256-rYQ3uLLcewloMv0uvJVbLG1T60Wxij5WdfOMLjYOjaQ=";
+    sha256 = "sha256-Y+GC8Zkznjr0pTvYED+uE1v6zIg+tq44F++ZrBytS1E=";
   };
 
-  vendorHash = "sha256-csKM/Cx+ALcUrMBGAEGGIsEItLNAhzvHc2lNBO2k+oc=";
+  vendorHash = "sha256-bAawCPfMR4B+mXBHzaTlKs0UYh07F30/epy4qkf2QhM=";
 
   checkPhase = ''
     runHook preCheck
diff --git a/pkgs/by-name/sy/sycl-info/package.nix b/pkgs/by-name/sy/sycl-info/package.nix
index 2de3aa080de3..d9256c7c9991 100644
--- a/pkgs/by-name/sy/sycl-info/package.nix
+++ b/pkgs/by-name/sy/sycl-info/package.nix
@@ -53,6 +53,6 @@ stdenv.mkDerivation {
     mainProgram = "sycl-info";
     platforms = platforms.linux;
     license = licenses.asl20;
-    maintainers = with maintainers; [ davidtwco ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/by-name/tf/tflint/package.nix b/pkgs/by-name/tf/tflint/package.nix
index ed98987a6188..03c992b9d9c8 100644
--- a/pkgs/by-name/tf/tflint/package.nix
+++ b/pkgs/by-name/tf/tflint/package.nix
@@ -11,7 +11,7 @@
 
 let
   pname = "tflint";
-  version = "0.55.1";
+  version = "0.56.0";
 in
 buildGoModule {
   inherit pname version;
@@ -20,10 +20,10 @@ buildGoModule {
     owner = "terraform-linters";
     repo = pname;
     tag = "v${version}";
-    hash = "sha256-TIMOsd/m0Z274HvTH1VZYezIN6EfLRPJMO8F9xXGyrI=";
+    hash = "sha256-Ku58lO3EHTFdWSd6xMdvjRlCuhEEXZc89GBFdGxhRBo=";
   };
 
-  vendorHash = "sha256-6FY9aZwbA3DpdaKNRquONu8DzYyacu9a1OZpeupdWoc=";
+  vendorHash = "sha256-Ht+MK1WwiM12swR99zle6V2rcuEXpx5B9Kj6um1g2t8=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/vs/vscode-extensions-update/package.nix b/pkgs/by-name/vs/vscode-extensions-update/package.nix
new file mode 100644
index 000000000000..80c333ddf23d
--- /dev/null
+++ b/pkgs/by-name/vs/vscode-extensions-update/package.nix
@@ -0,0 +1,5 @@
+{
+  writeScriptBin,
+}:
+
+writeScriptBin "vscode-extensions-update" (builtins.readFile ./vscode_extensions_update.py)
diff --git a/pkgs/by-name/vs/vscode-extensions-update/vscode-extensions-update-script.nix b/pkgs/by-name/vs/vscode-extensions-update/vscode-extensions-update-script.nix
new file mode 100644
index 000000000000..af432feb58e4
--- /dev/null
+++ b/pkgs/by-name/vs/vscode-extensions-update/vscode-extensions-update-script.nix
@@ -0,0 +1,13 @@
+{
+  lib,
+  vscode-extensions-update,
+}:
+
+{
+  attrPath ? null,
+  extraArgs ? [ ],
+}:
+
+[ "${lib.getExe vscode-extensions-update}" ]
+++ lib.optionals (attrPath != null) [ attrPath ]
+++ extraArgs
diff --git a/pkgs/by-name/vs/vscode-extensions-update/vscode_extensions_update.py b/pkgs/by-name/vs/vscode-extensions-update/vscode_extensions_update.py
new file mode 100755
index 000000000000..3819a9df6d67
--- /dev/null
+++ b/pkgs/by-name/vs/vscode-extensions-update/vscode_extensions_update.py
@@ -0,0 +1,323 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -i python3 -p nix python3 nodePackages.semver vsce nix-update gitMinimal
+
+import argparse
+import json
+import os
+import subprocess
+import sys
+
+
+class VSCodeExtensionUpdater:
+    """
+    A class to update VSCode extension version in nixpkgs.
+    """
+
+    def __init__(self):
+        self.parser = argparse.ArgumentParser(
+            description="Update VSCode extension version in nixpkgs."
+        )
+        self.parser.add_argument(
+            "attribute",
+            nargs="?",
+            default=os.getenv("UPDATE_NIX_ATTR_PATH"),
+            help="nix attribute path of the extension",
+        )
+        self.parser.add_argument(
+            "--override-filename", help="override-filename for nix-update"
+        )
+        self.parser.add_argument(
+            "--pre-release",
+            action="store_true",
+            help="allow check pre-release versions",
+        )
+        self.parser.add_argument(
+            "--platforms",
+            action="store_true",
+            help="set system according to meta.platforms for nix-update",
+        )
+        self.parser.add_argument(
+            "--commit", action="store_true", help="commit the updated package"
+        )
+        self.args = self.parser.parse_args()
+        self.attribute_path = self.args.attribute
+        if not self.attribute_path:
+            print("Error: Attribute path is required.", file=sys.stderr)
+            sys.exit(1)
+        self.target_vscode_version = self._get_nix_vscode_version()
+        self.current_version = self._get_nix_vscode_extension_version()
+        self.override_filename = self.args.override_filename
+        self.allow_pre_release = self.args.pre_release
+        self.commit = self.args.commit
+        self.extension_publisher = self._get_nix_vscode_extension_publisher()
+        self.extension_name = self._get_nix_vscode_extension_name()
+        self.extension_marketplace_id = (
+            f"{self.extension_publisher}.{self.extension_name}"
+        )
+        self.nix_system = self.get_nix_system()
+        self.nix_systems = self._get_nix_vscode_extension_platforms() or [
+            self.nix_system
+        ]
+        if not self.args.platforms and self.nix_system in self.nix_systems:
+            self.nix_systems = [self.nix_system]
+        else:
+            self.nix_systems = self.nix_systems[:1]
+        print(f"VSCode version: {self.target_vscode_version}")
+        print(f"Extension Marketplace ID: {self.extension_marketplace_id}")
+        print(f"Extension Current Version: {self.current_version}")
+
+    def execute_command(
+        self, commandline: list[str], env: dict[str, str] = None
+    ) -> str:
+        """
+        Executes a shell command and returns its output.
+        """
+        return subprocess.run(
+            commandline,
+            check=True,
+            capture_output=True,
+            text=True,
+            env=env,
+        ).stdout.strip()
+
+    def _get_nix_attribute(self, attribute_path: str) -> str:
+        """
+        Retrieves a raw Nix attribute value.
+        """
+        return self.execute_command(["nix", "eval", "--raw", "-f", ".", attribute_path])
+
+    def get_nix_system(self) -> str:
+        """
+        Retrieves system from Nix.
+        """
+        return self._get_nix_attribute("system")
+
+    def get_target_platform(self, nix_system: str) -> str:
+        """
+        Retrieves the VS Code targetPlatform variable based on the Nix system.
+        """
+        platform_mapping = {
+            "x86_64-linux": "linux-x64",
+            "aarch64-linux": "linux-arm64",
+            "armv7l-linux": "linux-armhf",
+            "x86_64-darwin": "darwin-x64",
+            "aarch64-darwin": "darwin-arm64",
+            "x86_64-windows": "win32-x64",
+            "aarch64-windows": "win32-arm64",
+        }
+        try:
+            return platform_mapping[nix_system]
+        except KeyError:
+            print(
+                f"Error: Unknown Nix system '{nix_system}'. Cannot determine targetPlatform.",
+                file=sys.stderr,
+            )
+            sys.exit(1)
+
+    def _get_nix_vscode_version(self) -> str:
+        """
+        Retrieves the current VSCode version from Nix.
+        """
+        return self._get_nix_attribute("vscode.version")
+
+    def _get_nix_vscode_extension_version(self) -> str:
+        """
+        Retrieves the extension current version from Nix.
+        """
+        return os.getenv("UPDATE_NIX_OLD_VERSION") or self._get_nix_attribute(
+            f"{self.attribute_path}.version"
+        )
+
+    def _get_nix_vscode_extension_platforms(self) -> list[str]:
+        """
+        Retrieves the extension meta.platforms from Nix.
+        """
+        try:
+            return json.loads(
+                self.execute_command(
+                    [
+                        "nix",
+                        "eval",
+                        "--json",
+                        "-f",
+                        ".",
+                        f"{self.attribute_path}.meta.platforms",
+                    ]
+                )
+            )
+        except subprocess.CalledProcessError:
+            return []
+
+    def _get_nix_vscode_extension_publisher(self) -> str:
+        """
+        Retrieves the extension publisher from Nix.
+        """
+        return self._get_nix_attribute(f"{self.attribute_path}.vscodeExtPublisher")
+
+    def _get_nix_vscode_extension_name(self) -> str:
+        """
+        Retrieves the extension name from Nix.
+        """
+        return self._get_nix_attribute(f"{self.attribute_path}.vscodeExtName")
+
+    def get_marketplace_extension_data(self, extension_id: str) -> dict:
+        """
+        Retrieves extension data from the VSCode Marketplace using vsce.
+        """
+        command = ["vsce", "show", extension_id, "--json"]
+        try:
+            with subprocess.Popen(
+                command,
+                stdout=subprocess.PIPE,
+                stderr=subprocess.PIPE,
+                text=True,
+            ) as proc:
+                data = json.load(proc.stdout)
+                proc.wait()
+                if proc.returncode != 0:
+                    err = proc.stderr.read()
+                    raise subprocess.CalledProcessError(
+                        proc.returncode, command, output=err
+                    )
+                return data
+        except json.JSONDecodeError:
+            print(
+                "Error: Couldn’t decode JSON response from VSCode marketplace; maybe the extension is not available?",
+                file=sys.stderr,
+            )
+            sys.exit(1)
+
+    def find_compatible_extension_version(
+        self, extension_versions: list, target_platform: str
+    ) -> str:
+        """
+        Finds the first compatible extension version based on Target Platform and VSCode compatibility.
+        """
+        for version_info in extension_versions:
+            candidate_platform = version_info.get("targetPlatform", None)
+            if candidate_platform is not None and candidate_platform != target_platform:
+                continue
+            candidate_version = version_info.get("version")
+            candidate_pre_release = next(
+                (
+                    prop.get("value")
+                    for prop in version_info.get("properties", [])
+                    if prop.get("key") == "Microsoft.VisualStudio.Code.PreRelease"
+                ),
+                None,
+            )
+            if candidate_pre_release and not self.allow_pre_release:
+                print(f"Skipping PreRelease version {candidate_version}")
+                continue
+            engine_version_constraint = next(
+                (
+                    prop.get("value")
+                    for prop in version_info.get("properties", [])
+                    if prop.get("key") == "Microsoft.VisualStudio.Code.Engine"
+                ),
+                None,
+            )
+            if engine_version_constraint:
+                print(
+                    f"Testing extension version: {candidate_version} with VSCode {self.target_vscode_version} (constraint: {engine_version_constraint})"
+                )
+                try:
+                    self.execute_command(
+                        [
+                            "semver",
+                            self.target_vscode_version,
+                            "-r",
+                            engine_version_constraint,
+                        ]
+                    )
+
+                    print(f"Compatible version found: {candidate_version}")
+                    return candidate_version
+                except (ValueError, subprocess.CalledProcessError):
+                    print(
+                        f"Version {candidate_version} is not compatible with VSCode {self.target_vscode_version} (constraint: {engine_version_constraint})."
+                    )
+                continue
+            return candidate_version
+        else:
+            print(
+                "Error: not found compatible version.",
+                file=sys.stderr,
+            )
+            sys.exit(1)
+
+    def run_nix_update(self, new_version: str, system: str) -> None:
+        """
+        Builds and executes the nix-update command.
+        """
+        if not self.override_filename:
+            self.override_filename = self.execute_command(
+                [
+                    "nix",
+                    "edit",
+                    "--extra-experimental-features",
+                    "nix-command",
+                    "-f",
+                    ".",
+                    self.attribute_path,
+                ],
+                env={**os.environ, "EDITOR": "echo"},
+            )
+            if (
+                "pkgs/applications/editors/vscode/extensions/vscode-utils.nix"
+                in self.override_filename
+            ) and os.path.exists(
+                "pkgs/applications/editors/vscode/extensions/default.nix"
+            ):
+                self.override_filename = (
+                    "pkgs/applications/editors/vscode/extensions/default.nix"
+                )
+        update_command = [
+            "nix-update",
+            self.attribute_path,
+            "--version",
+            new_version,
+            "--override-filename",
+            self.override_filename,
+            "--system",
+            system,
+        ]
+        self.execute_command(update_command)
+
+    def run(self):
+        marketplace_data = self.get_marketplace_extension_data(
+            self.extension_marketplace_id
+        )
+        available_versions = marketplace_data.get("versions", [])
+        print(
+            f"Total versions found for {self.extension_marketplace_id}: {len(available_versions)}"
+        )
+        self.new_version = self.find_compatible_extension_version(
+            available_versions, self.get_target_platform(self.nix_systems[0])
+        )
+        try:
+            self.execute_command(
+                ["semver", self.current_version, "-r", f"<{self.new_version}"]
+            )
+        except subprocess.CalledProcessError:
+            print("Already up to date or new version is older!")
+            sys.exit(0)
+        print(f"Selected extension version from Marketplace: {self.new_version}")
+        for i, system in enumerate(self.nix_systems):
+            version = self.new_version if i == 0 else "skip"
+            self.run_nix_update(version, system)
+        if self.commit:
+            self.execute_command(["git", "add", self.override_filename])
+            self.execute_command(
+                [
+                    "git",
+                    "commit",
+                    "-m",
+                    f"{self.attribute_path}: {self.current_version} -> {self.new_version}",
+                ]
+            )
+
+
+if __name__ == "__main__":
+    updater = VSCodeExtensionUpdater()
+    updater.run()
diff --git a/pkgs/by-name/vu/vulnix/package.nix b/pkgs/by-name/vu/vulnix/package.nix
index ff03799f0694..7ce9413457d8 100644
--- a/pkgs/by-name/vu/vulnix/package.nix
+++ b/pkgs/by-name/vu/vulnix/package.nix
@@ -6,21 +6,18 @@
   ronn,
 }:
 
-python3Packages.buildPythonApplication {
+python3Packages.buildPythonApplication rec {
   pname = "vulnix";
-  version = "1.10.2";
+  version = "1.11.0";
 
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "vulnix";
-    rev = "9abfc80da0b4135e982332e448a3969f3b28785b";
-    hash = "sha256-gSgAGN7LlciW4uY3VS49CbZ9WuRUcduJ5V7JesA8OVo=";
+    tag = version;
+    hash = "sha256-bQjmAmTRP/ce25hSP1nTtuDmUtk46DxkKWtylJRoj3s=";
   };
 
-  postPatch = ''
-    substituteInPlace setup.cfg \
-      --replace "--flake8" ""
-  '';
+  __darwinAllowLocalNetworking = true;
 
   outputs = [
     "out"
diff --git a/pkgs/by-name/wa/wavebox/package.nix b/pkgs/by-name/wa/wavebox/package.nix
index ef94daa0d320..121d60090bed 100644
--- a/pkgs/by-name/wa/wavebox/package.nix
+++ b/pkgs/by-name/wa/wavebox/package.nix
@@ -156,11 +156,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "wavebox";
-  version = "10.134.15-2";
+  version = "10.134.18-2";
 
   src = fetchurl {
     url = "https://download.wavebox.app/stable/linux/deb/amd64/wavebox_${finalAttrs.version}_amd64.deb";
-    hash = "sha256-lWwePNEobz+bx6JqLG6CVGmtQsUos+WlkBgIhpfl3LI=";
+    hash = "sha256-L2EXQuDHpHzqIeWeDl3rYzwrF/1sMtRIQSuGaVUEW5o=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/wo/wootility/package.nix b/pkgs/by-name/wo/wootility/package.nix
index 3ac31215ce8b..120627d4b6f8 100644
--- a/pkgs/by-name/wo/wootility/package.nix
+++ b/pkgs/by-name/wo/wootility/package.nix
@@ -48,7 +48,6 @@ appimageTools.wrapType2 {
     platforms = lib.platforms.linux;
     license = lib.licenses.unfree;
     maintainers = with lib.maintainers; [
-      davidtwco
       sodiboo
       returntoreality
     ];
diff --git a/pkgs/by-name/wo/wooting-udev-rules/package.nix b/pkgs/by-name/wo/wooting-udev-rules/package.nix
index 837668aa3edb..fabf716e3a51 100644
--- a/pkgs/by-name/wo/wooting-udev-rules/package.nix
+++ b/pkgs/by-name/wo/wooting-udev-rules/package.nix
@@ -19,7 +19,6 @@ stdenv.mkDerivation {
     platforms = platforms.linux;
     license = "unknown";
     maintainers = with maintainers; [
-      davidtwco
       returntoreality
     ];
   };
diff --git a/pkgs/by-name/xo/xonsh/unwrapped.nix b/pkgs/by-name/xo/xonsh/unwrapped.nix
index da1361b602bc..9f7a8e1873da 100644
--- a/pkgs/by-name/xo/xonsh/unwrapped.nix
+++ b/pkgs/by-name/xo/xonsh/unwrapped.nix
@@ -28,7 +28,7 @@
 
 buildPythonPackage rec {
   pname = "xonsh";
-  version = "0.19.3";
+  version = "0.19.4";
   pyproject = true;
 
   # PyPI package ships incomplete tests
@@ -36,7 +36,7 @@ buildPythonPackage rec {
     owner = "xonsh";
     repo = "xonsh";
     tag = version;
-    hash = "sha256-2ZxNVyONA9eFyasMK+49T98zl67/95BNfDp/gINPc1U=";
+    hash = "sha256-gOk0BZNuKsEzs72Lukq7+7vltmtPE75gEs+JyLqBDdc=";
   };
 
   build-system = [
diff --git a/pkgs/by-name/ya/yara-x/package.nix b/pkgs/by-name/ya/yara-x/package.nix
index 4d6766cb0b5d..2e9960fe6554 100644
--- a/pkgs/by-name/ya/yara-x/package.nix
+++ b/pkgs/by-name/ya/yara-x/package.nix
@@ -10,19 +10,19 @@
   yara-x,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "yara-x";
-  version = "0.13.0";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "VirusTotal";
     repo = "yara-x";
-    tag = "v${version}";
-    hash = "sha256-ZSJHvpRZO6Tbw7Ct4oD6QmuV4mJ4RGW5gnT6PTX+nC8=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-C8wBGmilouNcNN3HkwvSTWcZY1fe0jVc2TeWDN4w5xA=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-pD4qyw+TTpmcoX1N3C65VelYszYifm9sFOsEkXEysvo=";
+  cargoHash = "sha256-afCBuWr12trjEIDvE0qnGFxTXU7LKZCzZB8RqgqperY=";
 
   nativeBuildInputs = [
     installShellFiles
@@ -51,7 +51,7 @@ rustPlatform.buildRustPackage rec {
   meta = {
     description = "Tool to do pattern matching for malware research";
     homepage = "https://virustotal.github.io/yara-x/";
-    changelog = "https://github.com/VirusTotal/yara-x/releases/tag/v${version}";
+    changelog = "https://github.com/VirusTotal/yara-x/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [
       fab
@@ -59,4 +59,4 @@ rustPlatform.buildRustPackage rec {
     ];
     mainProgram = "yr";
   };
-}
+})
diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index 7de37ef6d685..c8c3b7c70336 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -98,7 +98,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "0.178.5";
+  version = "0.179.3";
 
   outputs =
     [ "out" ]
@@ -110,7 +110,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-YkoIOBoR5hMt99D1bJ1yWLv7C/rY6VKC5J/7c5SMUFs=";
+    hash = "sha256-9NJQ0uPID+YVtxDorh3tbokWmqIXNGqzUzIG5ConbWw=";
   };
 
   patches = [
@@ -136,7 +136,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     '';
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-xJaiHngsm74RdcEUXaDrc/Hwy4ywZrEiJt7JYTc/NpM=";
+  cargoHash = "sha256-45yY18I+n5RevPgvgXROAxS4Ub7+TzlAL7qKqEeYMTI=";
 
   nativeBuildInputs =
     [
diff --git a/pkgs/development/compilers/gnat-bootstrap/default.nix b/pkgs/development/compilers/gnat-bootstrap/default.nix
index 35c6b3e57e57..f69a58fdfada 100644
--- a/pkgs/development/compilers/gnat-bootstrap/default.nix
+++ b/pkgs/development/compilers/gnat-bootstrap/default.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, autoPatchelfHook, fetchzip, xz, ncurses5, ncurses, readline, gmp, mpfr
-, expat, libipt, zlib, dejagnu, sourceHighlight, python3, elfutils, guile, glibc
+, expat, libipt, zlib, dejagnu, sourceHighlight, python3, elfutils, guile, glibc, zstd
 , majorVersion
 }:
 
@@ -69,6 +69,11 @@ stdenv.mkDerivation(finalAttrs:
         hash = "sha256-pH3IuOpCM9sY/ppTYcxBmgpsUiMrisIjmAa/rmmZXb4=";
         upstreamTriplet = "x86_64-pc-linux-gnu";
       };
+      aarch64-linux = {
+        inherit url;
+        hash = "sha256-SVW/0yyj6ZH1GAjvD+unII+zSLGd3KGFt1bjjQ3SEFU=";
+        upstreamTriplet = "aarch64-linux-gnu";
+      };
     }.${stdenv.hostPlatform.system} or throwUnsupportedSystem;
   };
   inherit (versionMap.${majorVersion}) gccVersion alireRevision upstreamTriplet;
@@ -107,6 +112,11 @@ in {
     ncurses5
   ] ++ [
     xz
+  ] ++ lib.optionals (lib.versionAtLeast majorVersion "14"
+      && stdenv.hostPlatform.isAarch64
+      && stdenv.hostPlatform.isLinux) [
+    # not sure why the bootstrap binaries link to zstd only on this architecture but they do
+    zstd
   ];
 
   strictDeps = true;
@@ -187,7 +197,7 @@ in {
     homepage = "https://www.gnu.org/software/gnat";
     license = licenses.gpl3;
     maintainers = with maintainers; [ ethindp ];
-    platforms = [ "x86_64-linux" "x86_64-darwin" ];
+    platforms = [ "x86_64-linux" "x86_64-darwin" "aarch64-linux" ];
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
   };
 })
diff --git a/pkgs/development/emilua-plugins/this-thread/default.nix b/pkgs/development/emilua-plugins/this-thread/default.nix
index 97d8126f9de7..cb3e328c464a 100644
--- a/pkgs/development/emilua-plugins/this-thread/default.nix
+++ b/pkgs/development/emilua-plugins/this-thread/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "emilua-this-thread";
-  version = "1.0.2";
+  version = "1.0.3";
 
   src = fetchFromGitLab {
     owner = "emilua";
     repo = "this-thread";
     rev = "v${version}";
-    hash = "sha256-K9RQh/OnbQnqltfT9y36N/hEZxzbMP2aOJJ12FhAzHM=";
+    hash = "sha256-3f2nB6KwNka0P7jnvMZF2+ExuTmICj2NswmRWB+YDKo=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/libraries/science/math/or-tools/0001-Do-not-try-to-copy-pybind11_abseil-status-extension-.patch b/pkgs/development/libraries/science/math/or-tools/0001-Do-not-try-to-copy-pybind11_abseil-status-extension-.patch
new file mode 100644
index 000000000000..b3529481eb8e
--- /dev/null
+++ b/pkgs/development/libraries/science/math/or-tools/0001-Do-not-try-to-copy-pybind11_abseil-status-extension-.patch
@@ -0,0 +1,41 @@
+--- a/cmake/python.cmake
++++ b/cmake/python.cmake
+@@ -322,7 +322,6 @@
+ file(GENERATE OUTPUT ${PYTHON_PROJECT_DIR}/linear_solver/__init__.py CONTENT "")
+ file(GENERATE OUTPUT ${PYTHON_PROJECT_DIR}/linear_solver/python/__init__.py CONTENT "")
+ if(BUILD_MATH_OPT)
+-  file(GENERATE OUTPUT ${PYTHON_PROJECT_DIR}/../pybind11_abseil/__init__.py CONTENT "")
+   file(GENERATE OUTPUT ${PYTHON_PROJECT_DIR}/math_opt/__init__.py CONTENT "")
+   file(GENERATE OUTPUT ${PYTHON_PROJECT_DIR}/math_opt/core/__init__.py CONTENT "")
+   file(GENERATE OUTPUT ${PYTHON_PROJECT_DIR}/math_opt/core/python/__init__.py CONTENT "")
+@@ -635,9 +634,6 @@
+   COMMAND ${CMAKE_COMMAND} -E
+    $<IF:$<BOOL:${BUILD_MATH_OPT}>,copy,true>
+    $<TARGET_FILE:math_opt_pybind11> ${PYTHON_PROJECT}/math_opt/core/python
+-  COMMAND ${CMAKE_COMMAND} -E
+-   $<IF:$<BOOL:${BUILD_MATH_OPT}>,copy,true>
+-   $<TARGET_FILE:status_py_extension_stub> ${PYTHON_PROJECT}/../pybind11_abseil
+   COMMAND ${CMAKE_COMMAND} -E
+    $<IF:$<TARGET_EXISTS:pdlp_pybind11>,copy,true>
+    $<$<TARGET_EXISTS:pdlp_pybind11>:$<TARGET_FILE:pdlp_pybind11>> ${PYTHON_PROJECT}/pdlp/python
+@@ -696,7 +692,6 @@
+   COMMAND ${stubgen_EXECUTABLE} -p ortools.constraint_solver.pywrapcp --output .
+   COMMAND ${stubgen_EXECUTABLE} -p ortools.linear_solver.pywraplp --output .
+   COMMAND ${stubgen_EXECUTABLE} -p ortools.linear_solver.python.model_builder_helper --output .
+-  COMMAND ${stubgen_EXECUTABLE} -p pybind11_abseil.status --output .
+   COMMAND ${stubgen_EXECUTABLE} -p ortools.math_opt.core.python.solver --output .
+   COMMAND ${stubgen_EXECUTABLE} -p ortools.pdlp.python.pdlp --output .
+   COMMAND ${stubgen_EXECUTABLE} -p ortools.sat.python.cp_model_helper --output .
+--- a/ortools/python/setup.py.in
++++ b/ortools/python/setup.py.in
+@@ -83,10 +83,6 @@
+             '*.pyi',
+             'py.typed'
+         ],
+-        'pybind11_abseil':[
+-            '$<TARGET_FILE_NAME:status_py_extension_stub>',
+-            '*.pyi'
+-        ],
+         '@PYTHON_PROJECT@.math_opt':['*.pyi'],
+         '@PYTHON_PROJECT@.math_opt.core.python':[
+             '$<TARGET_FILE_NAME:math_opt_pybind11>',
diff --git a/pkgs/development/libraries/science/math/or-tools/default.nix b/pkgs/development/libraries/science/math/or-tools/default.nix
index 998ae934a397..4457003bbadf 100644
--- a/pkgs/development/libraries/science/math/or-tools/default.nix
+++ b/pkgs/development/libraries/science/math/or-tools/default.nix
@@ -23,21 +23,18 @@
 
 stdenv.mkDerivation rec {
   pname = "or-tools";
-  version = "9.11";
+  version = "9.12";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "or-tools";
     tag = "v${version}";
-    hash = "sha256-aRhUAs9Otvra7VPJvrf0fhDCGpYhOw1//BC4dFJ7/xI=";
+    hash = "sha256-5rFeAK51+BfjIyu/5f5ptaKMD7Hd20yHa2Vj3O3PkLU=";
   };
 
   patches = [
-    (fetchpatch {
-      name = "0001-Do-not-try-to-copy-pybind11_abseil-status-extension-.patch";
-      url = "https://build.opensuse.org/public/source/science/google-or-tools/0001-Do-not-try-to-copy-pybind11_abseil-status-extension-.patch?rev=19";
-      hash = "sha256-QHQ9E3mhTznJVKB+nP/9jct3uz+SPcOZ7w5tjOQ8iuk=";
-    })
+    # Rebased from https://build.opensuse.org/public/source/science/google-or-tools/0001-Do-not-try-to-copy-pybind11_abseil-status-extension-.patch?rev=19
+    ./0001-Do-not-try-to-copy-pybind11_abseil-status-extension-.patch
     (fetchpatch {
       name = "0001-Revert-python-Fix-python-install-on-windows-breaks-L.patch";
       url = "https://build.opensuse.org/public/source/science/google-or-tools/0001-Revert-python-Fix-python-install-on-windows-breaks-L.patch?rev=19";
diff --git a/pkgs/development/ocaml-modules/apron/default.nix b/pkgs/development/ocaml-modules/apron/default.nix
index f1206bab6ffb..308803b75ced 100644
--- a/pkgs/development/ocaml-modules/apron/default.nix
+++ b/pkgs/development/ocaml-modules/apron/default.nix
@@ -10,7 +10,7 @@
   findlib,
   camlidl,
   mlgmpidl,
-  flint,
+  flint3,
   pplite,
 }:
 
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     mpfr
     ppl
     camlidl
-    flint
+    flint3
     pplite
   ];
   propagatedBuildInputs = [ mlgmpidl ];
diff --git a/pkgs/development/ocaml-modules/mopsa/default.nix b/pkgs/development/ocaml-modules/mopsa/default.nix
index 456a7e85a663..f0f4196d3278 100644
--- a/pkgs/development/ocaml-modules/mopsa/default.nix
+++ b/pkgs/development/ocaml-modules/mopsa/default.nix
@@ -5,7 +5,7 @@
   clang,
   libclang,
   libllvm,
-  flint,
+  flint3,
   mpfr,
   pplite,
   ocaml,
@@ -39,7 +39,7 @@ buildDunePackage rec {
   buildInputs = [
     arg-complete
     camlidl
-    flint
+    flint3
     libclang
     mpfr
     pplite
diff --git a/pkgs/development/python-modules/ansi2html/default.nix b/pkgs/development/python-modules/ansi2html/default.nix
index 9ab201720ddf..faf70728277e 100644
--- a/pkgs/development/python-modules/ansi2html/default.nix
+++ b/pkgs/development/python-modules/ansi2html/default.nix
@@ -35,6 +35,6 @@ buildPythonPackage rec {
     mainProgram = "ansi2html";
     homepage = "https://github.com/ralphbean/ansi2html";
     license = licenses.lgpl3Plus;
-    maintainers = with maintainers; [ davidtwco ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/duckdb-engine/default.nix b/pkgs/development/python-modules/duckdb-engine/default.nix
index b91569d27eb8..612d8d7b89fb 100644
--- a/pkgs/development/python-modules/duckdb-engine/default.nix
+++ b/pkgs/development/python-modules/duckdb-engine/default.nix
@@ -69,6 +69,9 @@ buildPythonPackage rec {
   disabledTests = [
     # incompatible with duckdb 1.1.1
     "test_with_cache"
+    # these aren't set for some reason
+    "test_user_agent"
+    "test_user_agent_with_custom_user_agent"
   ] ++ lib.optionals (python.pythonVersion == "3.11") [
     # incompatible with duckdb 1.1.1
     "test_all_types_reflection"
diff --git a/pkgs/development/python-modules/langgraph-checkpoint-sqlite/default.nix b/pkgs/development/python-modules/langgraph-checkpoint-sqlite/default.nix
index d701b54db3f2..7bd37f352d69 100644
--- a/pkgs/development/python-modules/langgraph-checkpoint-sqlite/default.nix
+++ b/pkgs/development/python-modules/langgraph-checkpoint-sqlite/default.nix
@@ -31,8 +31,12 @@ buildPythonPackage rec {
     langgraph-checkpoint
   ];
 
-  # Checkpoint clients are lagging behind langgraph-checkpoint
-  pythonRelaxDeps = [ "langgraph-checkpoint" ];
+  pythonRelaxDeps = [
+    "aiosqlite"
+
+    # Checkpoint clients are lagging behind langgraph-checkpoint
+    "langgraph-checkpoint"
+  ];
 
   pythonImportsCheck = [ "langgraph.checkpoint.sqlite" ];
 
diff --git a/pkgs/development/python-modules/pulumi/default.nix b/pkgs/development/python-modules/pulumi/default.nix
index 89ae0e6193d4..c05401d20f74 100644
--- a/pkgs/development/python-modules/pulumi/default.nix
+++ b/pkgs/development/python-modules/pulumi/default.nix
@@ -20,7 +20,7 @@
 }:
 let
   inherit (pkgs.pulumi) pname version src;
-  inherit (pulumiPackages) pulumi-language-python;
+  inherit (pulumiPackages) pulumi-python;
   sourceRoot = "${src.name}/sdk/python";
 in
 buildPythonPackage {
@@ -63,7 +63,7 @@ buildPythonPackage {
     pytest
     pytest-asyncio
     pytest-timeout
-    pulumi-language-python
+    pulumi-python
   ];
 
   # https://github.com/pulumi/pulumi/blob/0acaf8060640fdd892abccf1ce7435cd6aae69fe/sdk/python/scripts/test_fast.sh#L10-L11
diff --git a/pkgs/development/python-modules/py-dmidecode/default.nix b/pkgs/development/python-modules/py-dmidecode/default.nix
index 893121ff1e3d..6114c564942a 100644
--- a/pkgs/development/python-modules/py-dmidecode/default.nix
+++ b/pkgs/development/python-modules/py-dmidecode/default.nix
@@ -34,7 +34,7 @@ buildPythonPackage rec {
     homepage = "https://github.com/zaibon/py-dmidecode/";
     changelog = "https://github.com/zaibon/py-dmidecode/releases/tag/v${version}";
     license = licenses.asl20;
-    maintainers = with maintainers; [ davidtwco ];
+    maintainers = [ ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/development/python-modules/sphinxcontrib-actdiag/default.nix b/pkgs/development/python-modules/sphinxcontrib-actdiag/default.nix
index 35eee667daf4..c3f22151b775 100644
--- a/pkgs/development/python-modules/sphinxcontrib-actdiag/default.nix
+++ b/pkgs/development/python-modules/sphinxcontrib-actdiag/default.nix
@@ -34,6 +34,6 @@ buildPythonPackage rec {
     description = "Sphinx actdiag extension";
     homepage = "https://github.com/blockdiag/sphinxcontrib-actdiag";
     license = licenses.bsd2;
-    maintainers = with maintainers; [ davidtwco ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/sphinxcontrib-nwdiag/default.nix b/pkgs/development/python-modules/sphinxcontrib-nwdiag/default.nix
index 56ca8292903c..34857eb5608a 100644
--- a/pkgs/development/python-modules/sphinxcontrib-nwdiag/default.nix
+++ b/pkgs/development/python-modules/sphinxcontrib-nwdiag/default.nix
@@ -34,6 +34,6 @@ buildPythonPackage rec {
     description = "Sphinx nwdiag extension";
     homepage = "https://github.com/blockdiag/sphinxcontrib-nwdiag";
     license = licenses.bsd2;
-    maintainers = with maintainers; [ davidtwco ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/sphinxcontrib-seqdiag/default.nix b/pkgs/development/python-modules/sphinxcontrib-seqdiag/default.nix
index fbca10bced53..3b178d927c44 100644
--- a/pkgs/development/python-modules/sphinxcontrib-seqdiag/default.nix
+++ b/pkgs/development/python-modules/sphinxcontrib-seqdiag/default.nix
@@ -34,6 +34,6 @@ buildPythonPackage rec {
     description = "Sphinx seqdiag extension";
     homepage = "https://github.com/blockdiag/sphinxcontrib-seqdiag";
     license = licenses.bsd2;
-    maintainers = with maintainers; [ davidtwco ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/webssh/default.nix b/pkgs/development/python-modules/webssh/default.nix
index f7166b86e459..deb657038054 100644
--- a/pkgs/development/python-modules/webssh/default.nix
+++ b/pkgs/development/python-modules/webssh/default.nix
@@ -37,7 +37,7 @@ buildPythonPackage rec {
     homepage = "https://github.com/huashengdun/webssh/";
     changelog = "https://github.com/huashengdun/webssh/releases/tag/v${version}";
     license = licenses.mit;
-    maintainers = with maintainers; [ davidtwco ];
+    maintainers = [ ];
     broken = stdenv.hostPlatform.isDarwin;
   };
 }
diff --git a/pkgs/development/ruby-modules/gem-config/default.nix b/pkgs/development/ruby-modules/gem-config/default.nix
index a6fcb8102a4e..38684bd94904 100644
--- a/pkgs/development/ruby-modules/gem-config/default.nix
+++ b/pkgs/development/ruby-modules/gem-config/default.nix
@@ -486,29 +486,6 @@ in
     '';
   };
 
-  # note that you need version >= v3.16.14.8,
-  # otherwise the gem will fail to link to the libv8 binary.
-  # see: https://github.com/cowboyd/libv8/pull/161
-  libv8 = attrs: {
-    buildInputs = [ which nodejs.libv8 python2 ];
-    buildFlags = [ "--with-system-v8=true" ];
-    dontBuild = false;
-    # The gem includes broken symlinks which are ignored during unpacking, but
-    # then fail during build. Since the content is missing anyway, touching the
-    # files is enough to unblock the build.
-    preBuild = ''
-      touch vendor/depot_tools/cbuildbot vendor/depot_tools/chrome_set_ver vendor/depot_tools/cros_sdk
-    '';
-    postPatch = ''
-      substituteInPlace ext/libv8/extconf.rb \
-        --replace "location = Libv8::Location::Vendor.new" \
-                  "location = Libv8::Location::System.new"
-    '';
-    meta.broken = true; # At 2023-01-20, errors as:
-                        #   "Failed to build gem native extension."
-                        # Requires Python 2. Project is abandoned.
-  };
-
   execjs = attrs: {
     propagatedBuildInputs = [ nodejs.libv8 ];
   };
diff --git a/pkgs/development/tools/build-managers/gradle/default.nix b/pkgs/development/tools/build-managers/gradle/default.nix
index ff23eda5f569..bb8961145f91 100644
--- a/pkgs/development/tools/build-managers/gradle/default.nix
+++ b/pkgs/development/tools/build-managers/gradle/default.nix
@@ -1,6 +1,8 @@
 {
+  jdk11,
   jdk17,
   jdk21,
+  jdk23,
 }:
 
 rec {
@@ -251,6 +253,7 @@ rec {
       concatTextFile,
       makeSetupHook,
       nix-update-script,
+      runCommand,
     }:
     gradle-unwrapped: updateAttrPath:
     lib.makeOverridable (
@@ -281,8 +284,33 @@ rec {
         passthru =
           {
             fetchDeps = callPackage ./fetch-deps.nix { inherit mitm-cache; };
-            inherit (gradle) jdk tests;
+            inherit (gradle) jdk;
             unwrapped = gradle;
+            tests = {
+              toolchains =
+                runCommand "detects-toolchains-from-nix-env"
+                  {
+                    # Use JDKs that are not the default for any of the gradle versions
+                    nativeBuildInputs = [
+                      (gradle.override {
+                        javaToolchains = [
+                          jdk11
+                          jdk23
+                        ];
+                      })
+                    ];
+                    src = ./tests/java-application;
+                  }
+                  ''
+                    cp -a $src/* .
+                    env GRADLE_USER_HOME=$TMPDIR/gradle org.gradle.native.dir=$TMPDIR/native \
+                      gradle javaToolchains --no-daemon --quiet --console plain > $out
+                    cat $out | grep "Language Version:   11"
+                    cat $out | grep "Detected by:        environment variable 'JAVA_TOOLCHAIN_NIX_0'"
+                    cat $out | grep "Language Version:   23"
+                    cat $out | grep "Detected by:        environment variable 'JAVA_TOOLCHAIN_NIX_1'"
+                  '';
+            } // gradle.tests;
           }
           // lib.optionalAttrs (updateAttrPath != null) {
             updateScript = nix-update-script {
diff --git a/pkgs/development/tools/rust/rustup-toolchain-install-master/default.nix b/pkgs/development/tools/rust/rustup-toolchain-install-master/default.nix
index 5f531bff222e..63ddaae84bd9 100644
--- a/pkgs/development/tools/rust/rustup-toolchain-install-master/default.nix
+++ b/pkgs/development/tools/rust/rustup-toolchain-install-master/default.nix
@@ -66,6 +66,6 @@ rustPlatform.buildRustPackage rec {
     mainProgram = "rustup-toolchain-install-master";
     homepage = "https://github.com/kennytm/rustup-toolchain-install-master";
     license = licenses.mit;
-    maintainers = with maintainers; [ davidtwco ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index 94060bf4f2f2..e9ac6d07ea69 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -16,16 +16,16 @@ let
   variants = {
     # ./update-zen.py zen
     zen = {
-      version = "6.13.7"; # zen
+      version = "6.14"; # zen
       suffix = "zen1"; # zen
-      sha256 = "1gziphpd8lqgz21d22n0pbnbms1qb2f5ri7y2jdfigrp45sh8kz3"; # zen
+      sha256 = "1lgzmjqybf4k7npwg2jkwmyxh0zfzhvbdpw3ajlr84i4sny2i6cy"; # zen
       isLqx = false;
     };
     # ./update-zen.py lqx
     lqx = {
-      version = "6.13.7"; # lqx
+      version = "6.13.8"; # lqx
       suffix = "lqx1"; # lqx
-      sha256 = "0zijfh3ibdqw9vii0pzj9ld4sj0dcx7i30hpq9cw8ij1q7mp82jc"; # lqx
+      sha256 = "0r61imcqlqndmjxgzjjb2p4g2kfxdndm32qzai2jcg21910c2j2m"; # lqx
       isLqx = true;
     };
   };
diff --git a/pkgs/servers/teleport/default.nix b/pkgs/servers/teleport/default.nix
index afa1a4b757b3..2a222f58aa9f 100644
--- a/pkgs/servers/teleport/default.nix
+++ b/pkgs/servers/teleport/default.nix
@@ -23,7 +23,6 @@ let
         buildGoModule = buildGo123Module;
       }
     );
-    teleport = teleport_16;
     teleport_17 = import ./17 (
       args
       // {
@@ -31,6 +30,7 @@ let
         buildGoModule = buildGo123Module;
       }
     );
+    teleport = teleport_17;
   };
   # Ensure the following callPackages invocation includes everything 'generic' needs.
   f' = lib.setFunctionArgs f (builtins.functionArgs (import ./generic.nix));
diff --git a/pkgs/tools/admin/pulumi-packages/base.nix b/pkgs/tools/admin/pulumi-packages/base.nix
deleted file mode 100644
index 5c5e9c687469..000000000000
--- a/pkgs/tools/admin/pulumi-packages/base.nix
+++ /dev/null
@@ -1,137 +0,0 @@
-{ buildGoModule
-, fetchFromGitHub
-, python3Packages
-}:
-let
-  mkBasePackage =
-    { pname
-    , src
-    , version
-    , vendorHash
-    , cmd
-    , extraLdflags
-    , env
-    , ...
-    }@args: buildGoModule (rec {
-      inherit pname src vendorHash version env;
-
-      sourceRoot = "${src.name}/provider";
-
-      subPackages = [ "cmd/${cmd}" ];
-
-      doCheck = false;
-
-      ldflags = [
-        "-s"
-        "-w"
-      ] ++ extraLdflags;
-    } // args);
-
-  mkPythonPackage =
-    { meta
-    , pname
-    , src
-    , version
-    , ...
-    }: python3Packages.callPackage
-      ({ buildPythonPackage, pythonOlder, parver, pip, pulumi, semver, setuptools }:
-      buildPythonPackage {
-        inherit pname meta src version;
-        format = "pyproject";
-
-        disabled = pythonOlder "3.7";
-
-        sourceRoot = "${src.name}/sdk/python";
-
-        propagatedBuildInputs = [
-          parver
-          pulumi
-          semver
-          setuptools
-        ];
-
-        postPatch = ''
-          if [[ -e "pyproject.toml" ]]; then
-            sed -i \
-              -e 's/^  version = .*/  version = "${version}"/g' \
-              pyproject.toml
-          else
-            sed -i \
-               -e 's/^VERSION = .*/VERSION = "${version}"/g' \
-               -e 's/^PLUGIN_VERSION = .*/PLUGIN_VERSION = "${version}"/g' \
-               setup.py
-          fi
-        '';
-
-        # Auto-generated; upstream does not have any tests.
-        # Verify that the version substitution works
-        checkPhase = ''
-          runHook preCheck
-
-          ${pip}/bin/pip show "${pname}" | grep "Version: ${version}" > /dev/null \
-            || (echo "ERROR: Version substitution seems to be broken"; exit 1)
-
-          runHook postCheck
-        '';
-
-        pythonImportsCheck = [
-          (builtins.replaceStrings [ "-" ] [ "_" ] pname)
-        ];
-      })
-      { };
-in
-{ owner
-, repo
-, rev
-, version
-, hash
-, vendorHash
-, cmdGen
-, cmdRes
-, extraLdflags
-, env ? { }
-, meta
-, fetchSubmodules ? false
-, ...
-}@args:
-let
-  src = fetchFromGitHub {
-    name = "source-${repo}-${rev}";
-    inherit owner repo rev hash fetchSubmodules;
-  };
-
-  pulumi-gen = mkBasePackage rec {
-    inherit src version vendorHash extraLdflags env;
-
-    cmd = cmdGen;
-    pname = cmdGen;
-  };
-in
-mkBasePackage ({
-  inherit meta src version vendorHash extraLdflags env;
-
-  pname = repo;
-
-  nativeBuildInputs = [
-    pulumi-gen
-  ];
-
-  cmd = cmdRes;
-
-  postConfigure = ''
-    pushd ..
-
-    chmod +w sdk/
-    ${cmdGen} schema
-
-    popd
-
-    VERSION=v${version} go generate cmd/${cmdRes}/main.go
-  '';
-
-  passthru.sdks.python = mkPythonPackage {
-    inherit meta src version;
-
-    pname = repo;
-  };
-} // args)
diff --git a/pkgs/tools/admin/pulumi-packages/default.nix b/pkgs/tools/admin/pulumi-packages/default.nix
deleted file mode 100644
index f46dffbfdfe8..000000000000
--- a/pkgs/tools/admin/pulumi-packages/default.nix
+++ /dev/null
@@ -1,16 +0,0 @@
-{ callPackage }:
-let
-  mkPulumiPackage = callPackage ./base.nix { };
-  callPackage' = p: args: callPackage p (args // { inherit mkPulumiPackage; });
-in
-{
-  pulumi-aws-native = callPackage' ./pulumi-aws-native.nix { };
-  pulumi-azure-native = callPackage' ./pulumi-azure-native.nix { };
-  pulumi-command = callPackage' ./pulumi-command.nix { };
-  pulumi-hcloud = callPackage' ./pulumi-hcloud.nix { };
-  pulumi-language-go = callPackage ./pulumi-language-go.nix { };
-  pulumi-language-nodejs = callPackage ./pulumi-language-nodejs.nix { };
-  pulumi-language-python = callPackage ./pulumi-language-python.nix { };
-  pulumi-random = callPackage' ./pulumi-random.nix { };
-  pulumi-yandex-unofficial = callPackage' ./pulumi-yandex-unofficial.nix { };
-}
diff --git a/pkgs/tools/misc/starship/default.nix b/pkgs/tools/misc/starship/default.nix
index 348529476681..094be04ce9a3 100644
--- a/pkgs/tools/misc/starship/default.nix
+++ b/pkgs/tools/misc/starship/default.nix
@@ -76,7 +76,6 @@ rustPlatform.buildRustPackage rec {
     license = licenses.isc;
     maintainers = with maintainers; [
       danth
-      davidtwco
       Br1ght0ne
       Frostman
     ];
diff --git a/pkgs/tools/text/diffr/default.nix b/pkgs/tools/text/diffr/default.nix
index 97e0247df632..e3502dd3c54f 100644
--- a/pkgs/tools/text/diffr/default.nix
+++ b/pkgs/tools/text/diffr/default.nix
@@ -31,6 +31,6 @@ rustPlatform.buildRustPackage rec {
     mainProgram = "diffr";
     homepage = "https://github.com/mookid/diffr";
     license = with licenses; [ mit ];
-    maintainers = with maintainers; [ davidtwco ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 22d0b9ba20f3..1df22e351d71 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4405,9 +4405,7 @@ with pkgs;
 
   pipecontrol = libsForQt5.callPackage ../applications/audio/pipecontrol { };
 
-  pulumiPackages = recurseIntoAttrs (
-    callPackage ../tools/admin/pulumi-packages { }
-  );
+  pulumiPackages = recurseIntoAttrs pulumi.pkgs;
 
   pulumi-bin = callPackage ../tools/admin/pulumi-bin { };
 
@@ -5779,7 +5777,7 @@ with pkgs;
       if stdenv.hostPlatform == stdenv.targetPlatform
          && stdenv.buildPlatform == stdenv.hostPlatform
       then buildPackages.gnat-bootstrap14
-      else buildPackages.gnat13;
+      else buildPackages.gnat14;
     stdenv =
       if stdenv.hostPlatform == stdenv.targetPlatform
          && stdenv.buildPlatform == stdenv.hostPlatform
@@ -7684,7 +7682,7 @@ with pkgs;
 
   gnumake = callPackage ../development/tools/build-managers/gnumake { };
   gradle-packages = import ../development/tools/build-managers/gradle {
-    inherit jdk17 jdk21;
+    inherit jdk11 jdk17 jdk21 jdk23;
   };
   gradleGen = gradle-packages.gen;
   wrapGradle = callPackage gradle-packages.wrapGradle { };
@@ -15144,6 +15142,9 @@ with pkgs;
 
   vscode-extensions = recurseIntoAttrs (callPackage ../applications/editors/vscode/extensions { });
 
+
+  vscode-extensions-update-script = callPackage ../by-name/vs/vscode-extensions-update/vscode-extensions-update-script.nix { };
+
   vscode-js-debug = callPackage ../by-name/vs/vscode-js-debug/package.nix {
     inherit (darwin.apple_sdk.frameworks) AppKit Security;
   };
@@ -16515,15 +16516,10 @@ with pkgs;
   or-tools = callPackage ../development/libraries/science/math/or-tools {
     inherit (darwin) DarwinTools;
     python = python3;
-    protobuf = protobuf_26.override {
+    protobuf = protobuf_29.override {
       abseil-cpp = abseil-cpp_202407;
     };
-    # or-tools builds with -std=c++17, so abseil-cpp must
-    # also be built that way
-    abseil-cpp = abseil-cpp_202407.override {
-      static = true;
-      cxxStandard = "17";
-    };
+    abseil-cpp = abseil-cpp_202407;
   };
 
   p4est-sc = callPackage ../development/libraries/science/math/p4est-sc {
diff --git a/pkgs/top-level/ruby-packages.nix b/pkgs/top-level/ruby-packages.nix
index 28664c0ae2eb..59871ad47fc9 100644
--- a/pkgs/top-level/ruby-packages.nix
+++ b/pkgs/top-level/ruby-packages.nix
@@ -2166,16 +2166,6 @@
     };
     version = "3.17.0.3";
   };
-  libv8 = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0kd4d5x9sxsbpbsk4xp66rxbmj2x3iglwirqws56wp7dzf7cd978";
-      type = "gem";
-    };
-    version = "8.4.255.0.1";
-  };
   libxml-ruby = {
     groups = ["default"];
     platforms = [];